State-backedChina MITRE G0006

APT1

Also known as COMMENT PANDA, PLA Unit 61398, Comment Crew, Byzantine Candor, Group 3, TG-8223, Comment Group, Brown Fox, GIF89a, ShadyRAT, G0006

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacks

Targets: Private sector, Government, United States, Taiwan, Israel, Norway, United Arab Emirates, United Kingdom, Singapore, India, Belgium, South Africa, Switzerland, Canada, France

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1005 Data from Local System T1007 System Service Discovery T1016 System Network Configuration Discovery T1021.001 Remote Desktop Protocol T1036.005 Match Legitimate Resource Name or Location T1049 System Network Connections Discovery T1057 Process Discovery T1059.003 Windows Command Shell T1087.001 Local Account T1114.001 Local Email Collection T1114.002 Remote Email Collection T1119 Automated Collection T1135 Network Share Discovery T1312 Compromise 3rd party infrastructure to support delivery T1326 Domain registration hijacking T1330 Acquire and/or use 3rd party software services T1333 Dynamic DNS T1346 Obtain/re-use payloads T1550.002 Pass the Hash T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1583.001 Domains T1584.001 Domains T1585.002 Email Accounts T1588.001 Malware T1588.002 Tool

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.