Threat actor · all actors

APT1G0006 state

aka APT1, Comment Crew, Comment Group, Comment Panda, PLA Unit 61398, Byzantine Candor, Group 3, TG-8223, Brown Fox, GIF89a, ShadyRAT, G0006

Last updated: 2026-07-03

2attributed CVEs

36ATT&CK techniques

4.4IDF score (tooling uniqueness)

0exclusive CVEs

2017–2021years active

About this actor

[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)

Source: MITRE ATT&CK

Activity timeline

2021 — 1 CVE published
2017 — 1 CVE published

Profile

CVE	Risk	CVSS	EPSS	Published	Products
`CVE-2017-6328`	5.5	8.8	0.0214	2017-08-11	see CVE
`CVE-2020-6789`	5.5	7.8	0.0035	2021-03-25	see CVE

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	21 / 36	58%
`CM-6`	19 / 36	53%
`CM-2`	16 / 36	44%
`AC-3`	13 / 36	36%
`AC-2`	12 / 36	33%
`SI-3`	12 / 36	33%
`AC-6`	11 / 36	31%
`CM-7`	10 / 36	28%
`AC-4`	9 / 36	25%
`IA-2`	9 / 36	25%
`SI-7`	9 / 36	25%
`AC-17`	8 / 36	22%
`CA-7`	8 / 36	22%
`AC-5`	7 / 36	19%
`CM-5`	7 / 36	19%

Co-occurring actors

APT41 2 shared CVEs
Deep Panda 2 shared CVEs
Leviathan 2 shared CVEs
menuPass 2 shared CVEs
Winnti Group 2 shared CVEs
APT3 2 shared CVEs
APT19 2 shared CVEs

Similar actors

Similar TTPs

Overlapping CVEs

Deep Panda 1.00
APT3 1.00
Winnti Group 1.00
menuPass 1.00
APT41 1.00