APT41__2021__the-operations-of-winnti-group.pdf

NTT Threat Detection documents Winnti Group (ENT-1) as a full-time, well-resourced APT active from Dec 2020–Apr 2021 targeting multiple countries and sectors across the Asia-Pacific region; the report details exploitation of GlassFish servers to host CobaltStrike and scanning infrastructure (Acunitex), use of Shadowpad/Spyder/Winnti backdoors and a custom CobaltStrike stager (“Fishmaster”), and supplies IPs, domains, and file hashes to support detection and response.