Threat group.View on attack.mitre.org
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.
| Technique | Procedure example |
|---|---|
| T1014 Rootkit |
Winnti Group used a rootkit to modify typical server functionality. |
| T1057 Process Discovery |
Winnti Group looked for a specific process running on infected servers. |
| T1083 File and Directory Discovery |
Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts. |
| T1105 Ingress Tool Transfer |
Winnti Group has downloaded an auxiliary program named ff.exe to infected machines. |
| T1553.002 Code Signing |
Winnti Group used stolen certificates to sign its malware. |
| T1583.001 Domains |
Winnti Group has registered domains for C2 that mimicked sites of their intended targets. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
