{
  "family": "winnti",
  "sample_count": 2,
  "category": "backdoor",
  "description": "Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracked as Winnti Group, Barium, Wicked Panda, and Double Dragon). Discovered in 2009 and continually modernized over more than a decade, Winnti specializes in software supply chain attacks, digital certificate theft, and intellectual property exfiltration against gaming, telecommunications, aerospace, and semiconductor corporations. Formally indicted by the US Department of Justice in September 2020, APT41 operators use Winnti to execute DLL side-loading via legitimate signed binaries, deploy malicious signed kernel-mode drivers to disable security defenses, and tunnel interactive command shells through custom encrypted protocols.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Winnti",
    "Winnti Backdoor",
    "Backdoor.Winnti",
    "Trojan:Win32/Winnti",
    "Winnti Trojan",
    "APT41 Core Backdoor",
    "Winnti Group Malware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Winnti malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Winnti is an advanced modular cyber espionage backdoor and rootkit platform developed by Chinese state-sponsored threat group APT41."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor operates Winnti?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Winnti is operated by APT41 (Winnti Group), whose members were formally indicted by the US Department of Justice in September 2020."
      }
    },
    {
      "@type": "Question",
      "name": "What is Winnti's signature execution method?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Winnti relies heavily on DLL side-loading, using legitimate, digitally signed executables to load malicious DLL payloads into memory."
      }
    },
    {
      "@type": "Question",
      "name": "How does Winnti evade endpoint detection systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Winnti deploys signed kernel-mode drivers to hide processes and hooks Windows network APIs to conceal unauthorized C2 communications."
      }
    },
    {
      "@type": "Question",
      "name": "What industries were targeted by Winnti campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Winnti campaigns targeted video game studios, telecommunications operators, pharmaceutical companies, and semiconductor manufacturers."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1195.002",
    "T1574.002",
    "T1014",
    "T1552.004",
    "T1059.003",
    "T1071.001",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1195.002",
      "name": "Compromise Software Supply Chain",
      "tactic": "initial-access"
    },
    {
      "id": "T1574.002",
      "name": "DLL Side-Loading",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1552.004",
      "name": "Private Keys",
      "tactic": "credential-access"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    }
  ],
  "cisa_advisory": "AA20-258A",
  "last_updated": "2026-10-14",
  "first_seen": 2009,
  "lineage": {
    "derived_from": [],
    "variants": [
      "winnti v1 (2009 gaming build)",
      "winnti v2 64-bit rootkit",
      "winnti v3 modular platform",
      "winnti v4 dll side-loader"
    ]
  },
  "attribution": [
    {
      "actor": "APT41 (Winnti Group / Barium / Wicked Panda)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2019-19781",
    "CVE-2020-10189"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "UDP",
      "HTTPS",
      "DNS"
    ],
    "ports": [
      443,
      53,
      8080
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c",
      "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e"
    ],
    "delivery": [
      "supply_chain_compromise",
      "spearphishing_attachments",
      "citrix_vpn_exploitation"
    ],
    "persistence": [
      "Windows Service Installation",
      "DLL Side-Loading Registry Keys"
    ]
  },
  "sources": [
    {
      "name": "US Department of Justice: Seven International Cyber Defendants, Including Five Chinese Hackers (APT41), Charged",
      "url": "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-five-chinese-hackers-associated-apt41-charged"
    },
    {
      "name": "CISA Alert AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Actors",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a"
    },
    {
      "name": "Novetta / Kaspersky: Operation Winnti Whitepaper and Research Analysis",
      "url": "https://securelist.com/"
    }
  ],
  "containment_steps": [
    "Engage a specialized Incident Response (IR) firm with APT threat actor experience immediately.",
    "Audit all corporate code-signing certificates and assume compromised digital keys must be revoked.",
    "Search enterprise environments for DLL side-loading behaviors and unbacked kernel driver registrations.",
    "Isolate compromised servers and conduct thorough forensic disk and memory imaging."
  ],
  "what_to_avoid": [
    "Do not treat Winnti as standard commodity malware; partial removal will cause the APT to activate backup implants.",
    "Avoid discussing incident response plans over compromised corporate email or unencrypted networks.",
    "Never allow untrusted signed kernel-mode drivers to load without strict driver signature enforcement (WHQL)."
  ],
  "target_industries": [
    "gaming",
    "telecommunications",
    "aerospace",
    "semiconductor",
    "pharmaceutical"
  ],
  "motivation": "State-Sponsored Cyber Espionage, Supply Chain Infiltration & Intellectual Property Theft",
  "threat_actors": [
    "APT41",
    "Winnti Group",
    "Chinese MSS"
  ],
  "target_geographies": [
    "US",
    "TW",
    "JP",
    "KR",
    "DE",
    "IN",
    "GB",
    "SG"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "defense-evasion",
    "credential-access",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}