G00447 cited sources

Winnti Group

Also tracked as Blackfly

Techniques Mapped6

Tools & Malware3

Campaigns TrackedNone published

Last Updated (MITRE)Jul 31, 2026

Description (MITRE ATT&CK)

Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.

Known Techniques by Tactic

Discovery (2)

Associated Tools & Malware

PipeMon (malware)Winnti for Windows (malware)PlugX (malware)

Seraph Context

Organisational Relevance

Shown when this actor's known techniques match your monitored environment.

Exploited CVE Correlation

Surfaced when a technique used by this actor maps to a tracked CISA KEV entry.

Sector & Regional Signal

Derived from MITRE's own published description text, never asserted beyond it.

Watchlist

Signed-in customers can track this actor and be notified of profile updates.

Is this actor relevant to your environment?

Match this actor's known techniques against the technologies you run inside Seraph CTI, and get notified if their profile changes.

Explore Seraph CTI Back to Threat Actors

Winnti Group

Description (MITRE ATT&CK)

Known Techniques by Tactic

Discovery (2)

Stealth (1)

Command And Control (1)

Resource Development (1)

Defense Impairment (1)