{
  "id": "winnti-group",
  "name": "Winnti Group",
  "aliases": [
    "Blackfly"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Chinese origin",
      "src": [
        "mitre-g0044"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2010,
      "src": [
        "mitre-g0044"
      ],
      "conf": "medium",
      "note": "At least 2010"
    },
    {
      "k": "attack_id",
      "v": "G0044",
      "src": [
        "mitre-g0044"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.",
      "src": [
        "mitre-g0044"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 6,
      "src": [
        "mitre-g0044"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "PipeMon, PlugX, Winnti for Windows",
      "src": [
        "mitre-g0044"
      ],
      "conf": "high",
      "note": "3 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0044)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/winnti-group.html",
  "sources": {
    "mitre-g0044": {
      "title": "Winnti Group, Group G0044",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0044/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}