APT1 (G0006) | Threat Actor Index

About APT1

APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.

View MITRE record ↗

Techniques by Tactic (23)

Resource Development

T1583.001 DomainsT1584.001 DomainsT1585.002 Email AccountsT1588.001 MalwareT1588.002 Tool

Initial Access

T1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1059.003 Windows Command Shell

Stealth

T1036.005 Match Legitimate Resource Name or Location

Credential Access

T1003.001 LSASS Memory

Discovery

T1007 System Service DiscoveryT1016 System Network Configuration DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1087.001 Local AccountT1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1550.002 Pass the Hash

Collection

T1005 Data from Local SystemT1114.001 Local Email CollectionT1114.002 Remote Email CollectionT1119 Automated CollectionT1560.001 Archive via Utility

Toolsets (17)

🐛

BISCUIT S0017

Malware · Windows

🐛

CALENDAR S0025

Malware · Windows

🐛

GLOOXMAIL S0026

Malware · Windows

🐛

PoisonIvy S0012

Malware · Windows

🐛

Seasalt S0345

Malware · Windows

🐛

WEBC2 S0109

Malware · Windows

🔧

Cachedump S0119

Tool · Windows

🔧

Lslsass S0121

Tool · Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Pass-The-Hash Toolkit S0122

Tool

🔧

PsExec S0029

Tool · Windows

🔧

Tasklist S0057

Tool

🔧

gsecdump S0008

Tool · Windows

🔧

ipconfig S0100

Tool

🔧

pwdump S0006

Tool · Windows

🔧

xCmd S0123

Tool

References & Reports (2)