APT1Threat actor
- brown fox
- byzantine candor
- comment crew
- comment group
- comment panda
- g0006
- gif89a
- Group 3
- pla unit 61398
- shadyrat
- tg-8223
PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacksFrom MISP Galaxy
Last reported 3 months ago, by Google Threat Intelligence4 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1684Social Engineering
“…ost of the incidents, scammers impersonated well-known local or international consumer brands, which is probably one of the oldest social engineering techniques used by the scam actors worldwide to establish trust with their victims.”
- T1219Remote Access Tools
“Remote access tools enable full victim device and account takeover.”
- T1497.001System Checks
“In case of success, the system checks for batch files in the “/test” directory of “Yandex.Disk” (PROFIND).”
- T1657Financial Theft
“Stage 5 : Account takeover & financial theft”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Updated Cyber Threat Actor Naming System“APT1) fails to provide defenders the critical context needed to operate quickly.”
-
Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia“Group 3: Taotie Malware Family”
-
Empty Box“Group 3”
-
The Art of Cyberwarfare“For example, unit 61398 from Shanghai is responsible for the actions of a well-known group called APT1 (aka Comment Crew), and unit 61419 from Qingdao has been linked to Tick.”
Indicators in its reports
named in the reports above- pajak.abfigo[.]ccin 1 report
- 004d80e0efe9ea4d…71dfa432f0a2in 1 report
- 00fcb2abd35049ad…ba156c0770cfin 1 report
- 02462bace6937e92…4ad270082104in 1 report
- 036aa79692470ad8…10af111317afin 1 report
- 03a1bcd3ba59c02c…3a2c075a6644in 1 report
- 041dcd27e1c77548…e1817cb3e9d0in 1 report
- 045144bfd86e0cf8…74a8d6eb4ee1in 1 report
- 047190859b100d01…ef8eba98ad28in 1 report
- 07701239a7003699…6e7b92800949in 1 report
- 0852fbee4372c194…5699f56448dcin 1 report
- 3f018345d993d0d8…67cc0e974dd4in 1 report
- 49acba8d46b57fdd…52750f51b844in 1 report
- 6f474c2d89850f90…bd52f0f99af0in 1 report
- 7b5c154e4aaa51b3…1b6eb70c1440in 1 report
- b125aea155d1d14b…1418c3f40ebcin 1 report
- ea87642a88788469…8b39709f1509in 1 report
- fd09c9c916436e13…276c159f198ain 1 report
- 2a954c7c1d764493…525c211fe768in 1 report
- 4bb5c9382fe37012…afa2efeb2cbcin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.