APT1 - G0006

Created: 2017-05-31T21:31:47.955Z

Modified: 2021-05-26T12:23:48.842Z

Contributors:

Aliases

APT1,Comment Crew,Comment Group,Comment Panda

Description

APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)

Techniques Used

APT1 has used various open-source tools for privilege escalation purposes.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

APT1 used publicly available malware for privilege escalation.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT1 has sent spearphishing emails containing malicious attachments.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT1 has sent spearphishing emails containing hyperlinks to malicious files.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

APT1 has registered hundreds of domains for use in operations.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|