APT1 — APT Profile
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.Also tracked as
Comment Crew, Comment Group, Comment Panda
Tools & malware
- BISCUIT Backdoor
- Cachedump Credential Harvesting
- CALENDAR Backdoor
- GLOOXMAIL Backdoor
- gsecdump Credential Harvesting
- ipconfig Network Reconnaissance
- Lslsass Credential Harvesting
- Mimikatz Credential Harvesting
- Net Network Reconnaissance
- Pass-The-Hash Toolkit Credential Harvesting
- PoisonIvy Remote Access Trojan
- PsExec Remote Execution
- pwdump Credential Harvesting
- Seasalt Backdoor
- Tasklist Discovery
- WEBC2 Backdoor
- win.auriga Backdoor
- win.bangat Backdoor
- win.biscuit Backdoor
- win.bouncer Backdoor
- win.combos Backdoor
- win.cookiebag Backdoor
- win.dairy Backdoor
- win.getmail Backdoor
- win.glooxmail Backdoor
- win.goggles Backdoor
- win.hacksfase Backdoor
- win.helauto Backdoor
- win.kurton Backdoor
- win.manitsme Backdoor
- win.mapiget Backdoor
- win.miniasp Backdoor
- win.newsreels Backdoor
- win.seasalt Backdoor
- win.starsypound Backdoor
- win.sword Backdoor
- win.tabmsgsql Backdoor
- win.tarsip Backdoor
- win.webc2_adspace Backdoor
- win.webc2_ausov Backdoor
- win.webc2_bolid Backdoor
- win.webc2_cson Backdoor
- win.webc2_div Backdoor
- win.webc2_greencat Backdoor
- win.webc2_head Backdoor
- win.webc2_kt3 Backdoor
- win.webc2_qbp Backdoor
- win.webc2_rave Backdoor
- win.webc2_table Backdoor
- win.webc2_ugx Backdoor
- win.webc2_yahoo Backdoor
- xCmd Remote Execution