Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT1 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06 · on the wire

APT1

  • COMMENT PANDA
  • PLA Unit 61398
  • Comment Crew
  • Byzantine Candor
  • Group 3
  • TG-8223
  • Comment Group
  • Brown Fox

state sponsor · ChinaMITRE G0006 ↗

APT1 — ATT&CK roseAP

attack rose · 23 techniques across 8 tactics

Last 30 days

last seen 10 d ago
dispatch1
victims0
CVE seen1

What changed

ledger · newest first
  1. —9 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacks

Observed targets (as stated by the sources)

15 countries · 2 sectors
United StatesTaiwanIsraelNorwayUnited Arab EmiratesUnited KingdomSingaporeIndiaBelgiumSouth AfricaSwitzerlandCanadaFranceLuxembourgJapanAssessed origin: China

assessed origin · Chinaobserved targets · 15

countries · 15

  • United States
  • Taiwan
  • Israel
  • Norway
  • United Arab Emirates
  • United Kingdom
  • Singapore
  • India
  • Belgium
  • South Africa
  • Switzerland
  • Canada
  • France
  • Luxembourg
  • Japan

sectors · 2

  • Private sector
  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

23 techniques · 8 of 15 tactics

  1. Resource development

    5 techniques

  2. Initial access

    2 techniques

  3. Execution

    1 technique

  4. Stealth

    1 technique

  5. Credential access

    1 technique

  6. Discovery

    6 techniques

  7. Lateral movement

    2 techniques

  8. Collection

    5 techniques

select a technique

Arsenal

6 malware · 11 tools
Malware
Malware · 6ATT&CK
SeasaltS0345 ↗
BISCUITS0017 ↗
GLOOXMAILS0026 ↗
PoisonIvyS0012 ↗
WEBC2S0109 ↗
CALENDARS0025 ↗
Tools
Tools · 11ATT&CK
ipconfigS0100 ↗
CachedumpS0119 ↗
PsExecS0029 ↗
LslsassS0121 ↗
MimikatzS0002 ↗
gsecdumpS0008 ↗
Pass-The-Hash ToolkitS0122 ↗
TasklistS0057 ↗
NetS0039 ↗
xCmdS0123 ↗
pwdumpS0006 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

On the wire

1 dispatch · newest first
  1. GHSA-jj3q-cwqj-842r: ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2013Comment Crew: Indicators Of CompromiseSymantec ↗

Take it with you

keyless · no signup

References

15 sources
  1. 1.en.wikipedia.org/wiki/PLA_Unit_61398
  2. 2.intelreport.mandiant.com/Mandiant_APT1_Report.pdf
  3. 3.cfr.org/interactive/cyber-operations/pla-unit-61398
  4. 4.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-re…
  5. 5.blog.trendmicro.com/trendlabs-security-intelligence/the-siesta-campaign-a-…
  6. 6.fireeye.com/blog/threat-research/2014/03/a-detailed-examination-of…
  7. 7.securingtomorrow.mcafee.com/other-blogs/mcafee-labs/operation-oceansalt-delivers-w…
  8. 8.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt…
  9. 9.community.broadcom.com/symantecenterprise/communities/community-home/libraryd…
  10. 10.attack.mitre.org/groups/G0006
  11. +5 more in the JSON record

Track APT1 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.