Threat actor profile
A source-linked view of reported activity, targets and related automated campaign clusters.
Background and history
APT41 is a China-linked threat group associated with both state-aligned espionage and financially motivated activity. Reporting spans government, healthcare, telecommunications, technology, gaming, travel and retail targets. The group has used phishing, software supply-chain access, web application exploitation and stolen credentials.
Researchers have tracked related activity since at least 2012, sometimes under the name Double Dragon and several narrower vendor labels. The mixture of strategic collection and apparent criminal activity makes this cluster unusually broad. It also means that not every operation attributed to APT41 will have the same objective or operating team.
Known aliases
APT41Double Dragon
Google Threat Intelligence Group · 24 Jul 2026
Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…
