Log in Request a demo

Threat group profile

APT1

Also known as Comment Crew, Comment Panda, Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations.

In short

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginChina
  2. Names4names in public reportsComment Crew · Comment Group · Comment Panda
  3. Sectors6named as targetsWestinghouse Electric Co. · United States Steel Corp. · Allegheny Technologies Inc.
  4. Techniques11in the attack chainResource Development · Initial Access · Execution
  5. Tools8tools and malware listedBISCUIT · WEBC2 · Seasalt

In one minute

Who they are
MITRE ATT&CK describes APT1 as a Chinese threat group attributed to the PLA General Staff Department's 3rd Department, Unit 61398. The US Department of Justice indicted five officers of Unit 61398 on 19 May 2014. An indictment is only an accusation.
Who they target
The indictment names six US victims in nuclear power, metals and solar products, including a labor union, over 2006 to 2014. It alleges the aim was to help competitors in China, including state-owned firms.
How they usually get in
The indictment describes spearphishing e-mails that installed malware. MITRE also lists credential dumping, pass the hash and Remote Desktop use once inside.
What stands out
The US Department of Justice called the 19 May 2014 charges the first time criminal charges were filed against known state actors for hacking. The government record here is the indictment and MITRE; no joint advisory names the group.
What to do first
Filter and authenticate inbound e-mail, train staff on spearphishing, and make local admin passwords unique so stolen hashes do not work elsewhere.

Names

Public reports use several names for this activity.

Names used for APT1
NameWhere it appears
Comment Crew MITRE ATT&CK G0006 (Associated Groups)[1]
Comment Group MITRE ATT&CK G0006 (Associated Groups)[1]
Comment Panda MITRE ATT&CK G0006 (Associated Groups)[1]
Unit 61398 (PLA General Staff Department 3rd Department, 2nd Bureau) MITRE ATT&CK G0006 and US indictment of 19 May 2014[1, 2]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Page version 1.4, modified 31 July 2026

    Describes APT1 as a Chinese threat group attributed to the 2nd Bureau of the PLA General Staff Department's 3rd Department, known as Unit 61398.[1]

  • US Department of Justice 19 May 2014

    A grand jury in the Western District of Pennsylvania indicted five Chinese military hackers for computer hacking, economic espionage and other offenses against six American victims.[2]

  • US Department of Justice 19 May 2014

    Named the defendants as officers in Unit 61398 of the Third Department of the Chinese People's Liberation Army (PLA).[2]

  • US Department of Justice 19 May 2014

    Alleged that three of the defendants hacked or tried to hack US entities, while two supported the conspiracy by managing infrastructure such as domain accounts.[2]

  • US Department of Justice 19 May 2014

    Said the FBI conducted the investigation and that the case was prosecuted by the National Security Division and the US Attorney's Office for the Western District of Pennsylvania.[2]

  • US Attorney General Eric Holder 19 May 2014

    Said the indictment was against five officers of the Chinese People's Liberation Army and that these were the first charges against known state actors for infiltrating US commercial targets by cyber means.[3]

  • US Department of Justice 19 May 2014

    Alleged the hacking was meant to steal information useful to competitors in China, including state-owned enterprises.[2]

  • US Department of Justice 19 May 2014

    Stated that an indictment is merely an accusation and a defendant is presumed innocent unless proven guilty in court.[2]

Who they target

Sectors

  • Westinghouse Electric Co.The US indictment alleges Sun stole technical and design specifications for AP1000 plant pipes and routing in 2010, and sensitive e-mails from senior decision-makers in 2010 and 2011.[2]
  • US subsidiaries of SolarWorld AGThe indictment alleges Wen and at least one other person stole thousands of files in 2012, including cash flow, costs and privileged legal communications.[2]
  • United States Steel Corp.The indictment alleges spearphishing e-mails in 2010 led to malware, and that Wang then stole hostnames and descriptions of US Steel computers.[2]
  • Allegheny Technologies Inc.The indictment alleges that in April 2012 Wen gained access and stole network credentials for virtually every employee.[2]
  • United Steel, Paper and Forestry, Rubber, Manufacturing, Energy, Allied Industrial and Service Workers International UnionThe indictment alleges Wen stole e-mails from senior employees about trade dispute strategy in 2012.[2]
  • Alcoa Inc.The indictment alleges a spearphishing e-mail in 2008 was followed by theft of thousands of e-mail messages and attachments.[2]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2006

    Start of the period charged

    The US indictment gives 2006 to 2014 as the time period. MITRE says the WEBC2 backdoor family was used by APT1 as early as July 2006.[2, 6]

  2. 2007

    BISCUIT backdoor

    MITRE says BISCUIT has been used by APT1 since as early as 2007.[5]

  3. February 2008

    Alcoa spearphishing

    The indictment alleges Sun sent a spearphishing e-mail to Alcoa about three weeks after it announced a partnership with a Chinese state-owned enterprise.[2]

  4. June 2008

    Alcoa e-mail theft

    The indictment alleges unidentified individuals stole thousands of e-mail messages and attachments from Alcoa.[2]

  5. 2010

    Westinghouse and US Steel

    The indictment alleges Sun stole AP1000 design specifications from Westinghouse and sent spearphishing e-mails to US Steel staff.[2]

  6. 2010

    Seasalt

    MITRE says the Seasalt malware has been linked to APT1's 2010 operations.[7]

  7. 2010 and 2011

    Westinghouse e-mails

    The indictment alleges Sun stole non-public e-mails of senior decision-makers at Westinghouse.[2]

  8. 2012

    SolarWorld

    The indictment alleges Wen and at least one other person stole thousands of files.[2]

  9. April 2012

    Allegheny Technologies

    The indictment alleges Wen gained access to the network and stole credentials for virtually every employee.[2]

  10. 2012

    Steelworkers union

    The indictment alleges Wen stole senior employees' e-mails; the union's computers kept beaconing to the conspiracy's infrastructure until at least early 2013.[2]

  11. 19 May 2014

    US indictment announced

    A grand jury in Western Pennsylvania indicted five officers of Unit 61398.[2, 3]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about APT1
DateWhoWhat
19 May 2014 US Department of Justice IndictmentA grand jury in the Western District of Pennsylvania indicted five PLA Unit 61398 officers on 31 counts, including economic espionage.[2, 3, 4]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Acquire Infrastructure: Domains T1583.001

    MITRE says APT1 registered hundreds of domains for use in operations. The indictment alleges two defendants managed domain accounts used for hacking.[1, 2, 14]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE says APT1 sent spearphishing e-mails with malicious attachments. The indictment describes spearphishing of US Steel and Alcoa staff.[1, 2, 11]

Execution

  • Command and Scripting Interpreter: Windows Command Shell T1059.003

    MITRE says APT1 used the Windows command shell and batch scripts to automate execution.[1]

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    MITRE says APT1 is known to have dumped credentials using Mimikatz.[1, 13]

Lateral Movement

  • Use Alternate Authentication Material: Pass the Hash T1550.002

    MITRE says APT1 is known to have used pass the hash.[1, 12]

  • Remote Services: Remote Desktop Protocol T1021.001

    MITRE says APT1 is known to have used RDP during operations.[1, 15]

Collection

  • Email Collection: Local Email Collection T1114.001

    MITRE says APT1 used GETMAIL to extract e-mails from archived Outlook .pst files.[1]

  • Email Collection: Remote Email Collection T1114.002

    MITRE says APT1 used MAPIGET to steal e-mail still on Exchange servers.[1]

  • Automated Collection T1119

    MITRE says APT1 used a batch script to run a series of discovery steps and save the output to a text file.[1]

  • Archive Collected Data: Archive via Utility T1560.001

    MITRE says APT1 used RAR to compress files before moving them out of the victim network.[1, 16]

Stealth

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    MITRE says the file name AcroRD32.exe, a legitimate Adobe Reader process name, was used as a name for malware.[1]

Tools and malware

  • BISCUIT Backdoor

    MITRE says it has been used by APT1 since as early as 2007.[1, 5]

  • WEBC2 Backdoor family

    MITRE says its backdoors fetch a web page from a set server, with commands hidden in HTML comments or special tags; used by APT1 as early as July 2006.[1, 6]

  • Seasalt Malware

    MITRE says it has been linked to APT1's 2010 operations.[1, 7]

  • CALENDAR Malware

    MITRE says it mimics legitimate Gmail Calendar traffic.[1, 8]

  • GLOOXMAIL Malware

    MITRE says it mimics legitimate Jabber/XMPP traffic.[1, 9]

  • PoisonIvy Remote access tool

    MITRE lists it for APT1 and describes it as a popular tool used by many groups.[1, 10]

  • Mimikatz Credential tool

    MITRE lists it for APT1 and says APT1 is known to have used it for credential dumping.[1]

  • PsExec Admin tool

    MITRE lists this Windows remote execution tool among APT1 software.[1]

Detection and defense

  1. Filter and authenticate e-mail

    MITRE advises scanning and removing malicious attachments, blocking unneeded attachment types, and using SPF, DKIM and DMARC to check senders.

    Counters T1566.001

  2. Train staff to spot spearphishing

    MITRE lists user training to identify social engineering and spearphishing e-mails.

    Counters T1566.001

  3. Monitor e-mail attachments and file transfers

    MITRE advises auditing attachments and file transfers and reviewing logs for odd activity.

    Counters T1566.001 T1560.001

  4. Protect the memory that holds sign-in secrets

    MITRE advises Credential Guard where supported and Protected Process Light for LSA.

    Counters T1003.001

  5. Make local admin passwords unique

    MITRE advises complex, unique local administrator passwords on every system.

    Counters T1003.001 T1550.002

  6. Limit shared admin accounts

    MITRE advises keeping domain accounts out of local administrator groups on many systems and limiting credential overlap.

    Counters T1550.002 T1003.001

  7. Apply pass the hash protections

    MITRE advises applying patch KB2871997 and UAC restrictions to local accounts on network logon.

    Counters T1550.002

  8. Disable weaker sign-in options

    MITRE advises considering disabling or restricting NTLM and WDigest.

    Counters T1003.001 T1550.002

What Brandefense can do

  • Phishing Monitoring & Domain Abuse

    Find look-alike domains and fake sign-in pages aimed at your staff, since the indictment describes spearphishing and managed domain accounts.

  • Dark Web Monitoring

    Watch for leaked or sold company credentials, since the indictment alleges theft of employee network credentials.

  • Cyber Threat Intelligence

    Follow what MITRE and the US Department of Justice report about this group and compare its listed techniques with your own controls.

  • Executive Protection

    Spot attempts to impersonate or target senior staff, whose e-mails the indictment alleges were stolen.

Questions

Who is APT1?

MITRE ATT&CK describes APT1 as a Chinese threat group attributed to PLA Unit 61398. On 19 May 2014 the US Department of Justice indicted five officers of that unit.

What else is it called?

MITRE lists Comment Crew, Comment Group and Comment Panda as associated names.

Who did it target?

The US indictment names Westinghouse, SolarWorld's US subsidiaries, US Steel, Allegheny Technologies, a steelworkers union and Alcoa, in nuclear power, metals and solar products.

How did it get in?

The indictment describes spearphishing e-mails. MITRE lists spearphishing attachments and links, then credential dumping and pass the hash.

Are the charges proven?

No. The Department of Justice says an indictment is only an accusation and a defendant is presumed innocent unless proven guilty in court.

What should I do first?

Filter attachments, turn on SPF, DKIM and DMARC, train staff on spearphishing, and make local admin passwords unique.

In our research

  1. APT19 (DEEP PANDA): A Persistent China-Aligned Espionage and Credential Theft Actor March 2026
  2. LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors February 2026
  3. APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT January 2026
  4. UNC4841 / SLIME57: China-Linked Espionage Threat Expanding Global Operations November 2025
  5. European Focused Threat Actors – APT Groups September 2022
  6. Dynamite Panda APT Group August 2022
  7. Cicada APT Group Targets Government Institutions April 2022

Sources

  1. APT1, Group G0006 MITRE ATT&CK Supports: Group description, associated names, techniques used, software list, attribution wording
  2. U.S. Charges Five Chinese Military Hackers for Cyber Espionage Against U.S. Corporations and a Labor Organization for Commercial Advantage U.S. Department of Justice, Office of Public Affairs Supports: Indictment of 19 May 2014: defendants, Unit 61398, victims, time period, charges, conduct by victim
  3. Attorney General Eric Holder Speaks at the Press Conference Announcing U.S. Charges Against Five Chinese Military Hackers for Cyber Espionage U.S. Department of Justice Supports: What the Attorney General said about the case on 19 May 2014
  4. Indictment, Exhibits A to E (defendant names and aliases) U.S. Department of Justice Supports: Names and online aliases of the five defendants
  5. BISCUIT, Software S0017 MITRE ATT&CK Supports: Backdoor used by APT1, since as early as 2007
  6. WEBC2, Software S0109 MITRE ATT&CK Supports: Backdoor family used by APT1 as early as July 2006
  7. Seasalt, Software S0345 MITRE ATT&CK Supports: Malware linked to APT1's 2010 operations
  8. CALENDAR, Software S0025 MITRE ATT&CK Supports: Malware that mimics Gmail Calendar traffic
  9. GLOOXMAIL, Software S0026 MITRE ATT&CK Supports: Malware that mimics Jabber/XMPP traffic
  10. PoisonIvy, Software S0012 MITRE ATT&CK Supports: Remote access tool listed for APT1
  11. Phishing: Spearphishing Attachment, T1566.001 MITRE ATT&CK Supports: Technique wording and mitigations (email filtering, SPF/DKIM/DMARC, training)
  12. Use Alternate Authentication Material: Pass the Hash, T1550.002 MITRE ATT&CK Supports: Technique wording and mitigations
  13. OS Credential Dumping: LSASS Memory, T1003.001 MITRE ATT&CK Supports: Technique wording and mitigations (Credential Guard, password policy)
  14. Remote Services: Remote Desktop Protocol, T1021.001 MITRE ATT&CK Supports: Technique name and tactic
  15. Acquire Infrastructure: Domains, T1583.001 MITRE ATT&CK Supports: Technique name and tactic
  16. Archive Collected Data: Archive via Utility, T1560.001 MITRE ATT&CK Supports: Technique name and tactic

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Active since 2009 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more

Technique

Command and Scripting Interpreter

Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.

Read more