- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398
- Agency named
- PLA, People's Liberation Army, Unit 61398
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2006–2026
- Status
- Active
- ATT&CK
- G0006 · 23 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0040 · apt1
ChinaWhat it is
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Comment Panda
- Government agency
- PLA Unit 61398
- Mandiant
- APT 1
- MITRE ATT&CK
- G0006
- Secureworks
- TG-8223
- Talos and others
- Group 3
- Operations
- Operation Shady RAT, Operation “Oceansalt”, Operation “Seasalt”, Operation “Siesta”
- Other names
- Comment Crew, Siesta, Brown Fox, BrownFox, Byzantine Candor, Byzantine Hades, Comment Crew, APT 1, Comment Group, GIF89a, Shady RAT, ShadyRAT, Shanghai Group
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Belgium, Canada, Denmark, France, Germany, Hong Kong, India, Indonesia, Israel, Japan, Luxembourg, Norway, Singapore, South Africa, South Korea, Switzerland, Taiwan, United Arab Emirates, United Kingdom, United States, Vietnam
- Sectors
- Aerospace, Chemical, Construction, Defense, Education, Energy, Engineering, Entertainment, Financial, Food and Agriculture, Government, Healthcare, High-Tech, Industrial, IT, Manufacturing, Media, Mining, Non-profit organizations, Private sector, Research, Satellites, Technology, Telecommunications, Think Tanks, Transportation
Tools
The tools and malware families the sources tie to it.
- Auriga
- BISCUIT
- BISCUIT and many others
- Bouncer
- CALENDAR
- Cachedump
- Combos
- CookieBag
- Cyber Eye RAT
- CyberGate
- Dairy
- Deeper RAT
- GDOCUPLOAD
- GLASSES
- GLOOXMAIL
- GOGGLES
- GREENCAT
- GetMail
- Hackfase
- Hacking Team UEFI Rootkit
- Helauto
- Kurton
- LIGHTBOLT
- LIGHTDART
- LONGRUN
- Living off the Land
- Lslsass
- MAPIget
- ManItsMe
- Mimikatz
- MiniASP
- Net
- NewsReels
- Oceansalt
- Pass-The-Hash Toolkit
- Poison Ivy
- PoisonIvy
- ProcDump
- PsExec
- Seasalt
- ShadyRAT
- StarsyPound
- Sword
- TabMsgSQL
- Tarsip
- Tasklist
- WARP
- WEBC2
- Xpert
- bangat
- gsecdump
- ipconfig
- pwdump
- xCmd
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de