APT1 (Comment Crew): Threat Actor Profile and Its Legacy for CTI

APT1, also tracked as Comment Crew, is the espionage group whose public exposure in 2013 changed how the security industry shares threat intelligence, yet many defenders know the name without knowing what the group actually did or why it still matters. APT1 is MITRE ATT&CK group G0006, a Chinese state-linked group that Mandiant attributed to Unit 61398 of the People's Liberation Army and that the US Department of Justice later named in a 2014 indictment. This guide profiles the group from primary sources: the Mandiant report, the ATT&CK group entry and the Department of Justice announcement. It explains how APT1 operated, maps its techniques to ATT&CK, and sets out the lessons for cyber threat intelligence (CTI) and detection teams today. It is a historic, defensive profile for CTI analysts, SOC leads and security architects; it describes individuals by group only. For how this group's many names relate, see the Threat Actor Naming Conventions Guide.

Key takeaways

• A long-running, industrial-scale espionage operation: Mandiant observed APT1 compromise 141 organisations across 20 industries from 2006, with an average access period of 356 days and a longest of 1,764 days.
• Credentials did most of the work: after phishing for a foothold, the group dumped and reused credentials, including pass the hash and logins to single-factor VPNs and Outlook Web Access.
• A CTI milestone: the 2013 report named a specific military unit and published more than 3,000 indicators, setting the pattern for public, evidence-led attribution by vendors.
• Government action followed: in May 2014 a US grand jury returned a 31-count indictment against five members of Unit 61398 for economic espionage against US companies and a labour union.
• The defensive lessons still hold: phishing-resistant MFA on remote access, credential hygiene, email collection monitoring and detection based on behaviour rather than published indicators.

What it is

APT1 is the name Mandiant gave to the most prolific of the Chinese espionage groups it tracked in the early 2010s. "APT" stands for advanced persistent threat; the number is Mandiant's tracking label. The ATT&CK entry describes APT1 as a Chinese threat group attributed to the 2nd Bureau of the PLA General Staff Department's 3rd Department, known by its Military Unit Cover Designator as Unit 61398, citing the Mandiant report.

Names and aliases

The Mandiant report was explicit about its confidence. It argued that the evidence bolstered the claim that APT1 is Unit 61398, and stated the only alternative it saw: an unlikely, secret, resourced organisation of mainland Chinese speakers operating from Shanghai infrastructure right outside Unit 61398's gates and doing the same work. That framing of an alternative hypothesis is part of why the report is still taught.

How it works

Mandiant described APT1 using its attack lifecycle model: initial recon, initial compromise, establish foothold, escalate privileges, internal recon, move laterally, maintain presence and complete mission. The pattern is summarised below at the level defenders need; no procedural detail is given.

• Initial compromise: spearphishing emails with malicious attachments (T1566.001) or links (T1566.002), often from webmail accounts created in the names of real people (T1585.002) and themed to the recipient.
• Foothold: "beachhead" backdoors, mostly the WEBC2 family (ATT&CK software S0109), which fetch a web page from attacker infrastructure and treat tagged content as commands. Mandiant held 400+ WEBC2 samples and saw the family in use from July 2006. Fuller backdoors such as BISCUIT (S0017) followed.
• Privilege escalation: credential dumping from memory (T1003.001) with public tools, and pass the hash (T1550.002) with stolen hashes. ATT&CK records use of public malware and open-source tools for this stage (T1588.001, T1588.002).
• Internal recon: built-in Windows commands run through the command shell and batch scripts (T1059.003) for account, process, service, share and network discovery (T1087.001, T1057, T1007, T1135, T1016, T1049).
• Lateral movement and presence: Remote Desktop (T1021.001), plus logins with stolen credentials to VPNs protected only by single-factor authentication and to web portals including Outlook Web Access. Malware used legitimate-looking names such as AcroRD32.exe (T1036.005).
• Complete mission: email theft with two utilities Mandiant had not seen elsewhere, GETMAIL for archived Outlook files (T1114.001) and MAPIGET for mail still on Exchange servers (T1114.002), then RAR archives (T1560.001) before exfiltration. Mandiant observed 6.5 TB of compressed data taken from one organisation over ten months.
• Infrastructure: hundreds of registered domains (T1583.001) and hijacked legitimate domains (T1584.001). In two years Mandiant saw at least 937 command and control servers on 849 IP addresses in 13 countries, and it attributed 2,551 fully qualified domain names to the group.

Technique to defence mapping

T1078 and T1071.001 are this guide's mapping of the behaviours the Mandiant report describes; the other IDs are recorded against G0006 in ATT&CK v20.

Why it matters

For cyber threat intelligence

• Public attribution with evidence: the report tied activity to a named unit using infrastructure registration, operator behaviour and location evidence. For example, in 1,849 of 1,905 observed Remote Desktop sessions the operator keyboard layout was Chinese (Simplified), and 817 of 832 source IPs resolved to China.
• Indicator sharing at scale: Mandiant released more than 3,000 indicators (domains, IP addresses, MD5 hashes), descriptions of over 40 malware families and 13 X.509 certificates. The report itself noted that publishing indicators shortens their lifespan, which is the trade-off every CTI team still weighs. See the Pyramid of Pain Guide.
• Lower bounds, not totals: Mandiant stated that its figures were lower bounds of the group's activity. Good CTI reporting still separates what was observed from what is inferred.
• From vendor report to government action: on 19 May 2014 the Department of Justice announced the indictment of five members of Unit 61398, alleging theft of trade secrets, executive emails, financial data, attorney-client communications and network credentials from companies in nuclear power, metals and solar, and from a labour union.

For defenders

APT1's tools are old, but its playbook is not. Phishing for a foothold, harvesting credentials, logging in to remote access that accepts a password alone, and quietly collecting email remain the most common espionage pattern. Most of the group's dwell time was spent using valid credentials, which is why identity controls and identity-centred detection would have shortened it most. See the Pass-the-Hash and Pass-the-Ticket Guide and the T1114 Email Collection Defensive Guide.

Measuring readiness against this pattern

• Share of remote access paths (VPN, webmail, VDI) that require phishing-resistant MFA.
• Share of Windows endpoints and servers with unique local administrator passwords and LSASS protection enabled.
• Time to detect simulated bulk mailbox access by a non-owner in purple team exercises.
• Number of accounts with mailbox-wide access rights such as impersonation, reviewed quarterly.
• Median dwell time in your own incidents, compared year on year.

Common misconceptions

• "APT1 indicators will catch APT1-style attacks": the published indicators are more than a decade old and were expected to go stale quickly. Hunt on behaviours such as credential dumping, pass the hash and bulk email access instead. See the Indicators of Compromise vs Indicators of Attack Guide.
• "Comment Crew is a different group": Comment Crew, Comment Group and Comment Panda are aliases of the same ATT&CK group, G0006.
• "Advanced means exotic exploits": APT1 relied mainly on phishing, public tools, built-in commands and stolen passwords. Its persistence and scale were the advanced part.
• "Attribution certainty is absolute": the report argued its case and stated an alternative hypothesis. Treat attribution as a confidence judgement and keep it separate from detection decisions.
• "Only defence contractors were targets": the 141 victims spanned 20 industries, and 87% were headquartered in countries where English is the native language.
• "The group is current": this is a historic profile. This guide makes no claim about present-day activity under the APT1 name; check current government advisories and ATT&CK before treating it as an active threat.

Related concepts

• Framework mapping: NIST CSF 2.0 ID.RA-02 (cyber threat intelligence received from sharing forums and sources), DE.CM-01 (networks monitored for adverse events) and DE.AE-02 (adverse events analysed). ATT&CK group G0006 and mitigation M1032 Multi-factor Authentication.
• Related profiles: see the APT10 Threat Actor Profile Guide and the APT41 Threat Actor Profile.
• Intelligence practice: see the Threat Intelligence Guide and the Threat Intelligence for Identity and NHI Guide.

Practitioner checklist

• Record APT1 in your threat library under ATT&CK G0006 with all aliases so reports using any name are linked.
• Enforce phishing-resistant MFA on every VPN, webmail and remote desktop gateway; remove password-only remote access.
• Deploy unique local administrator passwords and LSASS protection, and restrict NTLM where possible.
• Enable mailbox auditing and alert on bulk access by non-owners and on new impersonation or full-access grants.
• Alert on archive utilities running on servers and on large outbound transfers to new destinations.
• Build detections for the technique table above and test them in a purple team exercise based on the APT1 lifecycle.
• When consuming or publishing intelligence, separate observed facts, inferences and attribution confidence, and state lower bounds.
• Retire stale indicator feeds and prefer behavioural detections for long-lived actor patterns.

Standards and references

• MITRE ATT&CK: APT1 (G0006)
• Mandiant: APT1, Exposing One of China's Cyber Espionage Units
• US Department of Justice: US charges five Chinese military hackers for cyber espionage
• MITRE ATT&CK: WEBC2 (S0109)
• MITRE ATT&CK: Multi-factor Authentication (M1032)
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Threat Actor Naming Conventions Guide · Threat Intelligence Guide · Pass-the-Hash and Pass-the-Ticket Guide · APT10 Threat Actor Profile Guide