China-Linked Threat Group Targets Japanese Orgs' Servers

## Executive Summary Winnti (RevivalStone), a China‑affiliated APT linked to Earth Freybug/APT41, has been observed targeting Japanese manufacturing, materials, and energy companies by exploiting vulnerabilities in applications like IBM Lotus Domino and an ERP SQL injection to deploy web shells and multiple malware families (DEATHLOTUS, UNAPIMON, PRIVATELOG, CUNNINGPIGEON, WINDJAMMER, SHADOWGAZE). The actor collects credentials, conducts reconnaissance, and uses updated obfuscation, encryption, and evasion techniques to expand access — including breaches of managed service providers.