APT
ATLAS
Atlas
Actors
147
Names
471
Sectors
40
Requirements
480
⌘K
▸
sign in
Atlas
Actors
147
Names
471
Sectors
40
Requirements
480
LOADING
APT1 (aka Comment Crew, Byzantine Candor) · APT Atlas
Actors
/
Nation-state / APT
/
Asia
APT1
G0006
APT
CN · China
AKA
Comment Crew · Byzantine Candor · GIF89a · PLA Unit 61398 · Brown Fox
CrowdStrike
:
COMMENT PANDA
MITRE
:
G0006
Secureworks
:
IRON PANDA
PLA Unit 61398 cyber-espionage group; subject of the 2013 Mandiant APT1 report.
Targets
17
Sectors
15
Threat types
1
GIRs covered
0/480
Active since
2006
Pin to atlas
Watch
Share
Export
Also tracked as
4 vendor names · 5 other aliases
Open Rosetta Stone
CrowdStrike
COMMENT PANDA
Mandiant
APT1
MITRE
G0006
Secureworks
IRON PANDA
UNATTRIBUTED ALIASES
Comment Crew
Byzantine Candor
GIF89a
PLA Unit 61398
Brown Fox
Victimology
Geographic footprint · 17 countries
Region filter
Export
origin · China
targeted countries · 17
ASIA ·
6
United Arab Emirates
·
Israel
·
India
·
Japan
·
Singapore
·
Taiwan
EUROPE ·
8
Belgium
·
Switzerland
·
Denmark
·
France
·
United Kingdom
·
Italy
·
Luxembourg
·
Norway
AMERICAS ·
2
Canada
·
United States
AFRICA ·
1
South Africa
Sectors targeted
15 of 40
Government
100 actors
Aerospace
59 actors
Financial Services
74 actors
Healthcare
47 actors
Pharmaceutical
27 actors
Technology
60 actors
Telecom
72 actors
Retail & Hospitality
33 actors
Energy / Utilities
59 actors
Media & Journalism
49 actors
Transportation
31 actors
Food and Beverage
10 actors
Industrials / Engineering
29 actors
Chemicals
20 actors
Private Sector (generic)
29 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
ESP · Espionage
MITRE ATT&CK · 17 techniques
Initial Access
· 2
T1566.001
Spearphishing Attachment
T1566.002
Spearphishing Link
Execution
· 1
T1059.003
Windows Command Shell
Credential Access
· 1
T1003.001
LSASS Memory
Discovery
· 5
T1007
System Service Discovery
T1016
System Network Configuration Discovery
Lateral Movement
· 2
T1021.001
Remote Desktop Protocol
T1550.002
Pass the Hash
Collection
· 5
T1005
Data from Local System
T1114.001
Local Email Collection
T1114.002
Remote Email Collection
Stealth
· 1
T1036.005
Match Legitimate Resource Name or Location
GIR coverage
0 / 480 requirements satisfied
Open matrix
No GIRs mapped yet for this actor.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
17 techniques · layer format 4.5
Related actors
By origin and actor type
APT31
nation-state
China · 6 targets · since 2013
APT8
nation-state
China · 5 targets · since —
APT24
nation-state
China · 3 targets · since 2008
APT27
nation-state
China · 23 targets · since 2010
APT44
nation-state
Russia · 25 targets · since 2009
APT21
nation-state
China · 5 targets · since 2010
T1049
System Network Connections Discovery
T1057
Process Discovery
T1135
Network Share Discovery
T1119
Automated Collection
T1560.001
Archive via Utility