Actors/Nation-state / APT/Asia

APT1

G0006APTCN · China

AKA Comment Crew · Byzantine Candor · GIF89a · PLA Unit 61398 · Brown Fox · Comment Group · TG-8223

MITRE: G0006CrowdStrike: COMMENT PANDASecureworks: IRON PANDA

PLA Unit 61398 cyber-espionage group; subject of the 2013 Mandiant APT1 report.

Targets17

Sectors15

Threat types1

GIRs mapped0/480

Active since2006

Explore in atlas

Also tracked as

4 vendor names · 7 other aliases

Open Rosetta Stone

CrowdStrike

COMMENT PANDA

Mandiant

APT1

MITRE

G0006

Secureworks

IRON PANDA

UNATTRIBUTED ALIASESComment CrewByzantine CandorGIF89aPLA Unit 61398Brown FoxComment GroupTG-8223

Victimology

Geographic footprint · 17 countries

Export STIX

origin · Chinatargeted countries · 17

ASIA · 6

United Arab Emirates · Israel · India · Japan · Singapore · Taiwan

EUROPE · 8

Belgium · Switzerland · Denmark · France · United Kingdom · Italy · Luxembourg · Norway

AMERICAS · 2

Canada · United States

AFRICA · 1

South Africa

Sectors targeted

15 of 40

Government100 actors Aerospace58 actors Financial Services73 actors Healthcare46 actors Pharmaceutical26 actors Technology60 actors Telecom71 actors Retail & Hospitality32 actors Energy / Utilities58 actors Media & Journalism48 actors Transportation31 actors Food and Beverage9 actors Industrials / Engineering28 actors Chemicals20 actors Private Sector (generic)29 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 17 techniques

Initial Access · 2

T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution · 1

T1059.003Windows Command Shell

Credential Access · 1

T1003.001LSASS Memory

Discovery · 5

T1007System Service Discovery T1016System Network Configuration Discovery

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1550.002Pass the Hash

Collection · 5

T1005Data from Local System T1114.001Local Email Collection T1114.002Remote Email Collection

Stealth · 1

T1036.005Match Legitimate Resource Name or Location

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer17 techniques · layer format 4.5

Related actors

By origin and actor type

T1049

System Network Connections Discovery

T1057Process Discovery

T1135Network Share Discovery

T1119

Automated Collection

T1560.001Archive via Utility