APT1
APT1 is a Chinese state actor assessed in Mandiant’s 2013 report "APT1: Exposing One of China’s Cyber Espionage Units" as PLA Unit 61398. Known aliases in the provided content include Comment Crew, Comment Group, Comment Panda, and PLA Unit 61398. The content describes APT1 as an espionage-focused threat actor linked to breaches at hundreds of victim organizations, with attribution supported in part by Chinese (Simplified) — US keyboard layout artifacts. Reported tradecraft includes spearphishing and phishing emails as an initial access vector; use of the Windows command shell and batch scripts to automate execution and discovery; network configuration discovery using ipconfig /all; process discovery using tasklist /v; credential dumping; collection of files from local victims; use of RDP during operations; use of malware named to resemble legitimate software such as AcroRD32.exe; and use of publicly available or open-source malware and tools for privilege escalation. The content also notes infrastructure tradecraft associated with APT1 references, including use of varied domain registration information, different registrars, and private WHOIS services to hinder tracking.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
38 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
Observables
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example of a named threat actor whose operations were monitored across victim networks and later documented in a major threat report.
Known for using credential dumping in Windows environments.
Referenced as a threat actor associated with spearphishing attachment activity involving malicious file execution and potential credential capture via UDL files.
Listed as a threat actor associated with spearphishing attachments for initial access in this detection content.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.