ChinaFormally attributedActiveMITRE G0096

APT41

Coverage omission — Eastern

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Attribution signal

?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low
2.3
Low signal strength
Mentions3
Sources3
High conf.2
Last seenJun 2026
First observed
2019-09-23
Last active
Active
Origin
China — attributed by US DOJ to individuals affiliated with Chinese state security
Aliases
10
Techniques
82
Campaigns
7
China — attributed by US DOJ to individuals affiliated with Chinese state securityhigh confidence
TargetsTechnologyHealthcareTelecommunicationsGaming
RegionsUsEuApacIn

Attribution signals

3 mentions · 3 sources
#1assessed with medium-to-high confidence as attributable tohigh
MalwareInfrastructure
jpcert-blog
May 2026

"the activity was assessed with medium-to-high confidence as attributable to Earth Krahang."

Campaign: PONDSNAKE
#2targetedhigh
Victimology
dark-reading
Jun 2026

"China-linked Earth Krahang, for example, targeted Mexico, Brazil, and Paraguay in 2024"

#3also used bymoderate
Malware
cisco-talos
May 2026

"Draculoader: A generic shellcode loader deployed by UAT-8302, also used by the Earth Estries and Earth Naga APT groups who have histories of targeting government agencies in Southeast Asia and elsewhere."

Hedge terms observed

also used byassessed with medium-to-high confidence as attributable totargeted