Winnti Group

The Winnti Group, a collective of Chinese Advanced Persistent Threat (APT) groups including APT41, first gained notoriety for its attacks on computer game developers. The group was initially spotted by Kaspersky in 2013, but researchers suggest that this nation-state actor has been active since at least 2007. Known for their malicious activities, the Winnti Group has also been linked with other threat actor groups such as Hafnium, LuckyMouse, Tick, Calypso, and Hive0088, which are believed to be sponsored by the Chinese state. The group has been attributed to various cyber threats, including malware command and control through GitHub, as reported by Trend Micro. The group's infamous toolsets include PlugX, Mimikatz, and ShadowPad. The PlugX Command and Control (C&C) servers have been identified as back.rooter[.]tk and mm.portomnail[.]com. The group has used Mimikatz, a potent hacking tool, identified by the hashes 33C7C049967F21DA0F1431A2D134F4F1DE9EC27E and A0B86104E2D00B3E52BDA5808CCEED9842CE2CEA. In August 2021, SentinelLabs reported an IP address used as a ShadowPad C2 server, attributing it to the Winnti Group. The Winnti Group's activities have had significant impacts worldwide. Notably, Taiwan has accused the group of being behind a ransomware attack on its state oil company. Furthermore, Novetta released a report in 2014 detailing "Operation SMN," a large-scale malware eradication operation tied to the original Winnti Group. This evidence suggests that the group is not only capable of sophisticated cyberattacks but also poses a substantial threat to global cybersecurity.