Barium

Threat Actor Profile Updated 8 days ago

Download STIX

Preview STIX

Barium, also known as BRONZE ATLAS and part of the APT41 collective, is a China-linked cyberespionage group that has been active since at least 2007. It is associated with several other subgroups, including Wicked Panda, Winnti, Suckfly, and Blackfly. This threat actor has been responsible for various malicious activities over the years, such as deploying ShadowPad in 2017 to steal intellectual property and personally identifiable information (PII), as alleged by Microsoft. The group has also been linked with the use of the Winnti malware implant, working alongside another activity group, LEAD. The Barium group's operations have had significant impacts on multiple sectors. For instance, between May 2021 and February 2022, it infiltrated six U.S. state government networks using KEYPLUG, a backdoor tool disclosed by Google-owned Mandiant. Additionally, just hours before Microsoft released a patch on March 2, 2021, the group, also known as the Winnti Group or APT41, compromised the email servers of an oil company and a construction equipment company, both based in East Asia. Notably, LEAD and BARIUM are not typically associated with large-scale spear-phishing, suggesting their attacks are often more targeted and sophisticated. To mitigate the threats posed by groups like Barium, cybersecurity tools such as Windows Defender ATP have been employed. This system aids network security professionals in dealing with intrusions from activity groups like LEAD and BARIUM. Furthermore, Microsoft Threat Intelligence continually tracks these activity groups, documenting their tactics, techniques, and procedures, with a particular emphasis on the tools and infrastructure they use to facilitate attacks. This continuous monitoring and analysis help in developing more robust defenses against such sophisticated threat actors.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
APT41	6	APT41, also known as Winnti, Wicked Panda, and Wicked Spider, is a sophisticated threat actor attributed to China. This group has been active since at least 2012, targeting organizations across 14 countries. The group is known for its extensive use of various code families and tools, with at least 4
Winnti	5	Winnti is a sophisticated threat actor group, first identified by Kaspersky in 2013, with activities dating back to at least 2007. The group has been associated with the Chinese nation-state and is part of a collective known as APT41, which also includes subgroups like Wicked Panda, Suckfly, and Bar
Redgolf	2	RedGolf, a Chinese state-sponsored threat activity group, has been actively targeting Windows and Linux systems with the KEYPLUG backdoor. This group's activities have been closely associated with other threat groups including APT41, Wicked Panda, Bronze Atlas, and Barium. The first known use of the
Axiom	2	Axiom is a recognized threat actor, also known as a hacking team, that has been associated with malicious activities. The group has ties to the Chinese intelligence apparatus and has operated under various names such as Winnti, PassCV, APT17, LEAD, BARIUM, Wicked Panda, and GREF. The naming conventi
KEYPLUG	1	KeyPlug is a modular backdoor malware, written in C++, that has been used extensively by the APT41 group to target systems globally. Notably, between June and December 2021, it was heavily deployed against state government victims, exploiting Windows systems with significant effect. KeyPlug supports
Brass Typhoon	1	None
Suckfly	1	Suckfly, an advanced threat group, has been identified as conducting targeted attacks using multiple stolen certificates, hacktools, and custom malware. This group is not the only one to use certificates to sign malware, but they are possibly the most prolific collectors of them. The group's broad a
Wicked Panda	1	Wicked Panda, also known as APT41, Double Dragon, and Bronze Atlas, is a state-sponsored threat actor originating from China. Recognized as one of the top cyber threats by the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center, this group has been associated wit
Blackfly	1	Blackfly is a threat actor, tracked by Symantec, that has been involved in cyber-attacks primarily targeting South Korean companies, especially those in the video game and software development industry. The group initiated its activities with a campaign to steal certificates, which were later utiliz
Winnti Group	1	The Winnti Group, a collective of Chinese Advanced Persistent Threat (APT) groups including APT41, first gained notoriety for its attacks on computer game developers. The group was initially spotted by Kaspersky in 2013, but researchers suggest that this nation-state actor has been active since at l

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Windows

Apt

Microsoft

Malware Impl...

Reconnaissance

Exploits

Phishing

Backdoor

Android

State Sponso...

Espionage

Linux

Chinese

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Wyrmspy	Unspecified	2	WyrmSpy is a sophisticated malware attributed to the Chinese espionage group APT41, also known as Double Dragon, BARIUM, and Winnti. This harmful software, designed to exploit and damage computer systems or devices, infects systems through suspicious downloads, emails, or websites, often without use
DragonEgg	Unspecified	2	DragonEgg is a malware associated with the notorious Chinese Advanced Persistent Threat (APT) group, APT41. This malicious software was developed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. The malware has been linked to surveillance
ShadowPad	Unspecified	1	ShadowPad is a modular backdoor malware that has been utilized by several Chinese threat groups since at least 2017. Notably, it was used as the payload in supply chain attacks targeting South Asian governments, as reported in the VB2023 paper. ShadowPad provides near-administrative capabilities in

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
TAG-22	Unspecified	1	Threat Activity Group 22 (TAG-22), also known as RedHotel, is a suspected Chinese state-sponsored threat actor that has been identified by Recorded Future. This group has been actively targeting various sectors including telecommunications, academia, research and development, and government organiza

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Source Document References

Information about the Barium Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
DARKReading	8 days ago	China's APT41 Targets Global Logistics, Utilities Companies
CERT-EU	5 months ago	Hacking firm I-Soon data leak revealed Chinese gov hacking capabilities
CERT-EU	5 months ago	Connect the Dots on State-Sponsored Cyber Incidents - Targeting of Air India
CERT-EU	8 months ago	Researchers Unmask Sandman APT's Hidden Link to China-Based KEYPLUG Backdoor
CERT-EU	8 months ago	Connect the Dots on State-Sponsored Cyber Incidents - Targeting of Air India
Securityaffairs	10 months ago	Redfly group infiltrated an Asian national grid as long as six months
MITRE	a year ago	Exchange servers under siege from at least 10 APT groups \| WeLiveSecurity
MITRE	a year ago	Detecting threat actors in recent German industrial attacks with Windows Defender ATP - Microsoft Security Blog
CERT-EU	a year ago	NATO countries targeted by Winter Vivern via Zimbra vulnerability
CERT-EU	a year ago	Cyber Security Week In Review: July 21, 2023
BankInfoSecurity	a year ago	Chinese Threat Group APT41 Linked To Android Malware Attacks
CERT-EU	a year ago	Chinese APT41 Linked to WyrmSpy and DragonEgg Surveillanceware
CERT-EU	a year ago	Hackers target Pakistani government, bank and telecom provider with China-made malware
Secureworks	a year ago	ShadowPad Malware Analysis
CERT-EU	a year ago	Massive 3CX Supply-Chain Hack Targeted Cryptocurrency Firms
MITRE	a year ago	Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan
CERT-EU	a year ago	Windows, Linux systems subjected to Chinese state-backed cyberattacks
MITRE	a year ago	Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
Recorded Future	a year ago	With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets \| Recorded Future
CERT-EU	a year ago	In Other News: Military Emails Leaked, Google Restricts Internet Access, Chinese Spyware