CNChinaconfidence: 50G0006
APT1APT1
Also known as: COMMENT PANDA · PLA Unit 61398 · Comment Crew · Byzantine Candor · Group 3 · TG-8223 · Comment Group · Brown Fox · GIF89a · ShadyRAT · G0006 · APT1
Origin
CN
Known aliases
12
Target sectors
2
Attribution
State-sponsored
Profile
PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacks
Aliases· 12
COMMENT PANDAPLA Unit 61398Comment CrewByzantine CandorGroup 3TG-8223Comment GroupBrown FoxGIF89aShadyRATAPT1
Target sectors· 2
Private sectorGovernment
Known victims· 15
- United States
- Taiwan
- Israel
- Norway
- United Arab Emirates
- United Kingdom
- Singapore
- India
- Belgium
- South Africa
- Switzerland
- Canada
MITRE ATT&CK Group crosswalk
References
- https://en.wikipedia.org/wiki/PLA_Unit_61398
- http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
- https://www.cfr.org/interactive/cyber-operations/pla-unit-61398
- https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
- https://blog.trendmicro.com/trendlabs-security-intelligence/the-siesta-campaign-a-new-targeted-attack-awakens/
- https://www.fireeye.com/blog/threat-research/2014/03/a-detailed-examination-of-the-siesta-campaign.html
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/operation-oceansalt-delivers-wave-after-wave/
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.