Winnti GroupThreat actor
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.From MITRE ATT&CK
Last reported 4 months ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 51 · each with the sentence it comes from- T1007System Service Discovery
“T1007”
- T1008Fallback Channels
“T1008”
- T1010Application Window Discovery
“T1010”
- T1014Rootkit
“T1014”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“T1027.007”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Arsenal de FishMonger actualizado: SprySOCKS para Windows“…hino llamado I‑SOON (ver nuestro Q4 2023–Q1 2024 APT Activity Report)– es un grupo de ciberespionaje que forma parte del umbrella del Winnti Group y que muy probablemente opera desde China, específicamente desde la ciudad de Chengdu.”
-
FishMonger’s arsenal upgraded: SprySOCKS for Windows“…d by a Chinese contractor named I‑SOON (see our Q4 2023–Q1 2024 APT Activity Report) – is a cyberespionage group that falls under the Winnti Group umbrella and is most likely operating out of China, from the city of Chengdu.”
-
Update to the REF2924 intrusion set and related campaigns“REF2924 analytic update incorporating third-party and previously undisclosed incidents linking the REF2924 adversary to Winnti Group and ChamelGang along technical, tactical, and victim targeting lines.”
Indicators in its reports
named in the reports above- ffc3aa7909d4e72c…60dffe5c99b7in 2 reports
- 207.148.78[.]36in 2 reports
- 207.148.75[.]122in 2 reports
- 955bfc3dcc867256…0779fa3416d8in 2 reports
- 44dc4a08c5eb0972…4e06f09006bbin 2 reports
- ab87b29b6f79487c…9001e536f083in 2 reports
- 6490b8e4aade25a3…2db2122470bcin 2 reports
- e7484c24b88a1a24…9a993670285bin 2 reports
- 621d1952839be4b0…e5062ca368edin 2 reports
- 2457eed2ab28e377…9dad2c8079d4in 2 reports
- d2c706b1eaf662bf…73ed84bda24ain 2 reports
- 5f3b87cef56683d9…0d8019b559c4in 2 reports
Copy these 12 indicators · defanged
Thanks — we review every report.