Winnti Group

The Winnti Group, a threat actor associated with the Chinese state-sponsored hacking activities, has been active since at least 2007, according to researchers from Kaspersky Lab who first identified the group in 2013. The group initially gained notoriety for its attacks on computer game developers and has been linked to several other advanced persistent threat (APT) groups such as APT41, Hafnium, LuckyMouse, Tick, Calypso, and Hive0088. The Winnti Group's activities include exploiting backdoor access to servers, utilizing malware command and control systems, and engaging in ransomware attacks. Notably, Taiwan implicated the Winnti Group in a ransomware attack on its state oil company. The Winnti Group has utilized various sophisticated tools and techniques in their operations. They are known for using PlugX C&C servers, such as back.rooter[.]tk and mm.portomnail[.]com, and they have been attributed with the use of the Win64/HackTool.Mimikat.A Mimikatz, a powerful tool for credential theft. Furthermore, SentinelLabs reported that an IP address used as a ShadowPad C2 server in August 2021 was attributed to the Winnti Group. The group's involvement in the development of known toolsets was further confirmed by links to an entity named i-Soon. Several significant investigations and reports have detailed the Winnti Group's activities. In 2013, Kaspersky Lab reported technical details about the original Winnti Group and their methods. In 2014, Novetta released a report on "Operation SMN," a large-scale malware eradication operation linked to the original Winnti Group. Trend Micro also reported on attacks that abused GitHub for use in malware command and control, attributing these to the original Winnti Group. These reports highlight the group's persistent and evolving threat to cybersecurity.