APT1
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.
- ATT&CK ID
- G0006
- Origin
- China
- Techniques
- 20
- Tools
- 17
Also tracked as Comment Crew · Comment Group · Comment Panda
Techniques
Resource Development
Acquire InfrastructureCompromise InfrastructureEstablish AccountsObtain Capabilities
Initial Access
Execution
Command and Scripting Interpreter
Stealth
Credential Access
Discovery
System Service DiscoverySystem Network Configuration DiscoverySystem Network Connections DiscoveryProcess DiscoveryAccount DiscoveryNetwork Share Discovery
Lateral Movement
Remote ServicesUse Alternate Authentication Material
Collection
Data from Local SystemEmail CollectionAutomated CollectionArchive Collected Data
Software
BISCUIT · CALENDAR · Cachedump · GLOOXMAIL · Lslsass · Mimikatz · Net · Pass-The-Hash Toolkit · PoisonIvy · PsExec · Seasalt · Tasklist · WEBC2 · gsecdump · ipconfig · pwdump · xCmd