Threat intelligence / Malware

Winnti for Windows

[Winnti for Windows](https://attack.mitre.org/software/S0141) is a modular remote access Trojan (RAT) that has been used likely by multiple groups to carry out intrusions in various regions since at least 2010, including by one group referred to as the same name, [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: Kaspersky Winnti April 2013)(Citation: Microsoft Winnti Jan 2017)(Citation: Novetta Winnti April 2015)(Citation: 401 TRG Winnti Umbrella May 2018). The Linux variant is tracked separately under [Winnti for Linux](https://attack.mitre.org/software/S0430).(Citation: Chronicle Winnti for Linux May 2019)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Winnti for Windows](https://attack.mitre.org/software/S0141) is a modular remote access Trojan (RAT) that has been used likely by multiple groups to carry out intrusions in various regions since at least 2010, including by one group referred to as the same name, [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: Kaspersky Winnti April 2013)(Citation: Microsoft Winnti Jan 2017)(Citation: Novetta Winnti April 2015)(Citation: 401 TRG Winnti Umbrella May 2018). The Linux variant is tracked separately under [Winnti for Linux](https://attack.mitre.org/software/S0430).(Citation: Chronicle Winnti for Linux May 2019)

Labels

malware

24 recorded

Relationships

uses

from Aquatic Panda

Group

uses

to Bypass User Account Control

Technique

uses

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Environmental Keying

Technique

uses

to External Proxy

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Proxy

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Service Execution

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

uses

from Winnti Group

Group

6 external

References

mitre-attack

S0141

Microsoft Winnti Jan 2017

https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Chronicle Winnti for Linux May 2019

https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a

401 TRG Winnti Umbrella May 2018

https://401trg.github.io/pages/burning-umbrella.html

Kaspersky Winnti April 2013

https://securelist.com/winnti-more-than-just-a-game/37029/

Novetta Winnti April 2015

https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf