APT1
- ID
- G0006
- Associated names
- Comment Crew, Comment Group, Comment Panda
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. [1]
Techniques used (23)
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1007 System Service Discovery
- T1016 System Network Configuration Discovery
- T1021.001 Remote Desktop Protocol
- T1036.005 Match Legitimate Resource Name or Location
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1087.001 Local Account
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1135 Network Share Discovery
- T1550.002 Pass the Hash
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1583.001 Domains
- T1584.001 Domains
- T1585.002 Email Accounts
- T1588.001 Malware
- T1588.002 Tool
Software used (17)
- S0002 Mimikatz
- S0006 pwdump
- S0008 gsecdump
- S0012 PoisonIvy
- S0017 BISCUIT
- S0025 CALENDAR
- S0026 GLOOXMAIL
- S0029 PsExec
- S0039 Net
- S0057 Tasklist
- S0100 ipconfig
- S0109 WEBC2
- S0119 Cachedump
- S0121 Lslsass
- S0122 Pass-The-Hash Toolkit
- S0123 xCmd
- S0345 Seasalt