APT1 — APT Profile
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
Comment Crew, Comment Group, Comment Panda, Byzantine Candor, BrownFox, TG-8223, Shanghai Group, GIF89a, PLA Unit 61398, ShadyRAT, G0006
IntelFusions coverage (1)
- Mandiant Unmasks APT1 as China's PLA Unit 61398 in Landmark Cyber Espionage Exposé 2026-02-16 · Nation-State
Tools & malware
- BISCUIT Backdoor
- Cachedump Credential Harvesting
- CALENDAR Backdoor
- GLOOXMAIL Backdoor
- gsecdump Credential Harvesting
- ipconfig Network Reconnaissance
- Lslsass Credential Harvesting
- Mimikatz Credential Harvesting
- Net Network Reconnaissance
- Pass-The-Hash Toolkit Credential Harvesting
- PoisonIvy Remote Access Trojan
- PsExec Remote Execution
- pwdump Credential Harvesting
- Seasalt Backdoor
- Tasklist Discovery
- WEBC2 Backdoor
- win.auriga Backdoor
- win.bangat Backdoor
- win.biscuit Backdoor
- win.bouncer Backdoor
- win.combos Backdoor
- win.cookiebag Backdoor
- win.dairy Backdoor
- win.getmail Backdoor
- win.glooxmail Backdoor
- win.goggles Backdoor
- win.hacksfase Backdoor
- win.helauto Backdoor
- win.kurton Backdoor
- win.manitsme Backdoor
- win.mapiget Backdoor
- win.miniasp Backdoor
- win.newsreels Backdoor
- win.seasalt Backdoor
- win.starsypound Backdoor
- win.sword Backdoor
- win.tabmsgsql Backdoor
- win.tarsip Backdoor
- win.webc2_adspace Backdoor
- win.webc2_ausov Backdoor
- win.webc2_bolid Backdoor
- win.webc2_cson Backdoor
- win.webc2_div Backdoor
- win.webc2_greencat Backdoor
- win.webc2_head Backdoor
- win.webc2_kt3 Backdoor
- win.webc2_qbp Backdoor
- win.webc2_rave Backdoor
- win.webc2_table Backdoor
- win.webc2_ugx Backdoor
- win.webc2_yahoo Backdoor
- xCmd Remote Execution
Vendor research
- APT1 Exposing One of China’s Cyber Espionage Units Mandiant
- APT1 Threat Actor Profile - Tactics, Techniques, and Updates Huntress
- Threat Actor Profile: Comment Crew (APT1) Cyble
- CrowdStrike Intelligence Report: Putter Panda Crowdstrike
- Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units Mandiant
Countries linked to this actor
- South Africa targets
- China origin