APT1

APT1, also known as Unit 61398 or Comment Crew, is a notorious cyber-espionage group believed to be part of China's People's Liberation Army (PLA) General Staff Department's 3rd Department. This threat actor has been linked with several high-profile Remote Access Trojans (RATs), enabling them to take complete control over a victim's machine. APT1 has systematically stolen hundreds of terabytes of data from at least 141 organizations across various sectors including Information Technology, Aerospace, Public Administration, and more, demonstrating the capability and intent to steal from multiple organizations simultaneously. The size of APT1’s infrastructure suggests a large organization with potentially hundreds of human operators. This group came into the spotlight following Mandiant's APT1 report in 2013, which attributed the attacks to the Chinese government. This was followed by indictments of the APT1 actors by the U.S. Department of Justice and foreign policy maneuvers against the Chinese government by the U.S. State Department. It is worth noting that APT1 has been associated with other Chinese threat actors such as APT10 and DragonOK. They have previously used dynamic DNS, and while they occasionally use publicly available backdoors like Poison Ivy and Gh0st RAT, they mostly seem to employ their own custom backdoors. Despite similarities in code observed between OceanSalt samples and those of APT1, these are believed to be false flags. APT1 also creates webmail accounts using real peoples’ names, indicating sophisticated social engineering techniques. Their wider targeting scope coupled with the use of the Winnti backdoor is typical of several suspected Ministry of State Security contractors, including APT1 and APT41. The threat posed by APT1 remains significant due to its extensive capabilities, resources, and the backing of a nation-state.