{
  "id": "apt1",
  "name": "APT1",
  "aliases": [
    "Comment Crew",
    "Comment Group",
    "Comment Panda"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.",
  "specs": [
    {
      "k": "sponsor",
      "v": "PLA General Staff Department 3rd Department, Unit 61398",
      "src": [
        "mitre-g0006"
      ],
      "conf": "high"
    },
    {
      "k": "attack_id",
      "v": "G0006",
      "src": [
        "mitre-g0006"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 23,
      "src": [
        "mitre-g0006"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BISCUIT, Cachedump, CALENDAR, GLOOXMAIL, gsecdump, ipconfig, Lslsass, Mimikatz, Net, Pass-The-Hash Toolkit, PoisonIvy, PsExec, pwdump, Seasalt, Tasklist, WEBC2, xCmd",
      "src": [
        "mitre-g0006"
      ],
      "conf": "high",
      "note": "17 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0006)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/apt1.html",
  "sources": {
    "mitre-g0006": {
      "title": "APT1, Group G0006",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0006/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}