Barium

Barium, also known as BRONZE ATLAS or APT41, is a threat actor that has been associated with various malicious activities. Originating from China and active since at least 2007, this group has been implicated in cyberespionage efforts targeting multiple sectors across the globe. In 2017, according to a Microsoft complaint, Barium deployed ShadowPad malware to steal intellectual property and personally identifiable information (PII). The group is part of the larger APT41 collective, which includes other subgroups like Wicked Panda, Winnti, SuckFly, and more. These groups have been involved in extensive data theft, compromising trade secrets, intellectual property, and sensitive data from organizations in the US and several other countries. Barium and its associated groups are strongly linked with the use of Winnti malware implant, an advanced persistent threat (APT) tool used for large-scale cyber-espionage operations. This malware has been employed by both BARIUM and LEAD activity groups. A notable incident occurred between May 2021 and February 2022 when Barium infiltrated six U.S. state government networks using KEYPLUG, a backdoor tool disclosed by Google-owned Mandiant. Earlier, on March 2, 2021, just hours before Microsoft released a patch, the Winnti Group (another name for Barium) compromised the email servers of an oil company and a construction equipment company based in East Asia. To counter these threats, tools like Windows Defender ATP are instrumental in helping network security professionals deal with intrusions from activity groups like LEAD and BARIUM. Although these groups are not known for large-scale spear-phishing, their sophisticated tactics pose significant risks to organizational cybersecurity. Microsoft Threat Intelligence continually tracks activity groups such as LEAD and BARIUM, documenting their tactics, techniques, procedures, and the tools they use to facilitate attacks, thereby aiding in the development of effective defensive strategies.