Background
The Winnti Group is a Chinese state-linked cyber espionage umbrella encompassing multiple related threat clusters that share malware, infrastructure, and operational techniques. Active since at least 2009, the group originally gained attention for targeting the online gaming industry but has since expanded operations to encompass technology, pharmaceutical, telecommunications, and semiconductor companies worldwide.
Winnti operates at the intersection of state-sponsored espionage and financially motivated cybercrime. The group has conducted operations that serve Chinese state intelligence objectives while simultaneously pursuing profit through theft of digital certificates, gaming currencies, and intellectual property. This dual mandate complicates attribution and distinguishes Winnti from purely espionage-focused Chinese APTs.
The U.S. Department of Justice has issued multiple indictments against individuals associated with the Winnti ecosystem, including charges against members of APT41 for computer intrusion campaigns targeting over 100 companies worldwide. German prosecutors have also investigated Winnti intrusions into major chemical and pharmaceutical companies.
Notable Campaigns
Gaming Industry Targeting (2009-2013) — Winnti''s earliest documented operations targeted online gaming companies in South Korea, Japan, Taiwan, and Southeast Asia. The group stole digital certificates for code signing, gaming source code, and in-game virtual currencies, establishing the foundational infrastructure and tooling that would later be used for state espionage.
CCleaner Supply Chain Attack (2017) — A sophisticated supply chain attack compromised the build environment of CCleaner, a widely used system utility, injecting malware into legitimate updates distributed to approximately 2.27 million users. The second-stage payload selectively targeted specific technology and telecommunications companies, demonstrating Winnti''s ability to conduct precision targeting at scale.
ASUS Live Update Supply Chain Attack (2018-2019) — Operation ShadowHammer compromised ASUS''s update mechanism to distribute backdoored firmware updates to approximately 500,000 users. The payload only activated on systems with specific MAC addresses, indicating highly targeted intelligence collection through a mass distribution channel.
German Chemical/Pharmaceutical Companies (2019-2020) — Winnti-associated actors compromised major German chemical companies Bayer, BASF, and Covestro, along with pharmaceutical firm Roche. The intrusions focused on intellectual property theft related to chemical processes and pharmaceutical research.
Tactics, Techniques & Procedures
Winnti is primarily known for supply chain attacks — compromising software build systems, update mechanisms, and trusted vendor relationships to distribute malware through legitimate channels. This approach provides broad access while targeting specific high-value organizations through selective payload deployment.
The group extensively uses stolen digital certificates to sign their malware, making detection significantly more difficult as signed code bypasses many security controls. Winnti maintains a library of stolen certificates from previous compromises, rotating them across campaigns.
Post-compromise operations use a combination of the Winnti backdoor, ShadowPad, and commodity tools. The group employs DLL side-loading, process injection, and rootkit techniques for stealth. Lateral movement leverages credential theft and living-off-the-land techniques.
Tools & Malware
Winnti Backdoor — The group''s namesake malware, a modular backdoor with kernel-level rootkit capabilities. Features encrypted C2 communications and plugin-based architecture supporting keylogging, file operations, and network tunneling.
ShadowPad — Modular backdoor platform that has become the most widely shared tool across Chinese APT groups. Originally developed by Winnti-associated actors, ShadowPad provides encrypted C2, plugin loading, and anti-analysis capabilities. Used in supply chain attacks and direct intrusions.
Spyder — Lightweight backdoor used for initial access and reconnaissance before deploying more capable tools. Features minimal footprint to reduce detection risk during early compromise stages.
CROSSWALK — Cross-platform backdoor with Windows and Linux variants, providing modular functionality and encrypted C2. Used in campaigns targeting technology and telecommunications companies.
Indicators & Detection
Supply chain monitoring is critical for organizations in Winnti-targeted sectors. Verify the integrity of software updates through hash verification and monitor build systems for unauthorized modifications. Implement code signing certificate monitoring to detect use of stolen certificates.
Network detection should focus on identifying ShadowPad and Winnti backdoor C2 patterns. Both use encrypted HTTP/HTTPS communications with characteristic beaconing intervals. Monitor for DNS queries to dynamically generated domains used for C2 resolution.
Endpoint monitoring should watch for DLL side-loading of unsigned DLLs by signed executables, kernel driver loading from non-standard locations, and process injection into legitimate system processes. Pay particular attention to development environments and build servers, which are primary targets for supply chain compromise.