APT1
Also known as: Comment Crew, Comment Panda, Comment Group
APT1 is a landmark case study. Mandiant's 2013 report was one of the first detailed public attributions of an espionage group to a specific military unit, and it helped make the term APT mainstream. The group relied on spearphishing, credential theft and pass-the-hash to spread through networks and steal large volumes of data.
- Public attribution
- Attributed by Mandiant in 2013 to the People's Liberation Army (PLA) Unit 61398; in 2014 the US Department of Justice indicted five officers of that unit.
- Active since
- Around 2006
- Targets
- Organisations across multiple industries
- Intellectual property and business data
Notable campaigns
2006-2013Economic espionage campaign
Mandiant documented intrusions at 141 victims across multiple industries.
2014US indictment of PLA officers
Five Unit 61398 officers were charged with economic espionage against US companies.
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1566.002Phishing: Spearphishing Link
- T1003.001OS Credential Dumping: LSASS Memory
- T1550.002Use Alternate Authentication Material: Pass the Hash
- T1021.001Remote Services: Remote Desktop Protocol
- T1560.001Archive Collected Data: Archive via Utility
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Use unique local administrator passwords (LAPS) and restrict admin logons to defeat pass-the-hash.
- Protect LSASS and remove standing admin rights from user workstations.
- Train staff to report spearphishing and sandbox attachments.
- Monitor for large outbound transfers and archive creation on file servers.