Winnti Group
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--c5947e1c-1cbc-434c-94b8-27c7e3be0fff
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (6)
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits ar
Software & Tools (3)
PipeMon is a multi-stage modular backdoor used by Winnti Group.(Ci
PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita
Winnti for Windows is a modular remote access Trojan (RAT) that has been used likely by multiple groups to
Explore this actor's full graph with Ninja Signal