What even is Winnti? - Risky Business
Tags
country: China Hong Kong Thailand
attack-pattern: Data Code Signing Certificates - T1587.002 Code Signing Certificates - T1588.003 Credentials - T1589.001 Digital Certificates - T1596.003 Digital Certificates - T1587.003 Digital Certificates - T1588.004 Dns - T1071.004 Dns - T1590.002 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Social Media - T1593.001 Software - T1592.002 Vulnerabilities - T1588.006 Brute Force - T1110 Rootkit - T1014 Rootkit
Show in Graph
Common Information
Type Value
UUID b178a8a3-84b2-478e-8c3a-b3fe384ab0cc
Fingerprint bd31871f996107ad
Analysis status DONE
Considered CTI value 1
Text language
Published July 20, 2020, midnight
Added to db Sept. 26, 2022, 9:30 a.m.
Last updated Nov. 17, 2024, 6:54 p.m.
Headline What even is Winnti?
Title What even is Winnti? - Risky Business
Detected Hints/Tags/Attributes 85/2/2
Source URLs
Redirection Url
Details Source https://risky.biz/whatiswinnti/
URL Provider
Details Provider Source level domain
Details risky.biz risky.biz
Attributes
Details Type #Events CTI Value
Details Threat Actor Identifier - APT 297 
APT27
Details Threat Actor Identifier - APT 522 
APT41