All actors

APT1

Also reported as Comment Crew, Comment Group, TG-8223, Group 3, Byzantine Candor and 10 other names. Linked to China by three sources.

Reports
138
Last reported
Known CVEs
94
Techniques in ATT&CK
23
Origin
China
ID
G0006
Merge evidence
25 alias matches

Reports per quarter

  1. 2011 Q2: 1 report
  2. 2011 Q3: 1 report
  3. 2011 Q4: 2 reports
  4. 2012 Q1: no reports
  5. 2012 Q2: no reports
  6. 2012 Q3: 1 report
  7. 2012 Q4: no reports
  8. 2013 Q1: 8 reports
  9. 2013 Q2: 1 report
  10. 2013 Q3: 6 reports
  11. 2013 Q4: 3 reports
  12. 2014 Q1: 6 reports
  13. 2014 Q2: 1 report
  14. 2014 Q3: 3 reports
  15. 2014 Q4: 2 reports
  16. 2015 Q1: no reports
  17. 2015 Q2: 1 report
  18. 2015 Q3: 1 report
  19. 2015 Q4: no reports
  20. 2016 Q1: 2 reports
  21. 2016 Q2: 6 reports
  22. 2016 Q3: 5 reports
  23. 2016 Q4: 1 report
  24. 2017 Q1: no reports
  25. 2017 Q2: 5 reports
  26. 2017 Q3: 1 report
  27. 2017 Q4: 2 reports
  28. 2018 Q1: 2 reports
  29. 2018 Q2: 4 reports
  30. 2018 Q3: 1 report
  31. 2018 Q4: 2 reports
  32. 2019 Q1: 3 reports
  33. 2019 Q2: 3 reports
  34. 2019 Q3: 6 reports
  35. 2019 Q4: 3 reports
  36. 2020 Q1: 3 reports
  37. 2020 Q2: 2 reports
  38. 2020 Q3: no reports
  39. 2020 Q4: 7 reports
  40. 2021 Q1: 5 reports
  41. 2021 Q2: 4 reports
  42. 2021 Q3: 5 reports
  43. 2021 Q4: no reports
  44. 2022 Q1: 2 reports
  45. 2022 Q2: no reports
  46. 2022 Q3: 1 report
  47. 2022 Q4: 2 reports
  48. 2023 Q1: no reports
  49. 2023 Q2: no reports
  50. 2023 Q3: no reports
  51. 2023 Q4: 1 report
  52. 2024 Q1: 1 report
  53. 2024 Q2: no reports
  54. 2024 Q3: no reports
  55. 2024 Q4: no reports
  56. 2025 Q1: no reports
  57. 2025 Q2: no reports
  58. 2025 Q3: no reports
  59. 2025 Q4: no reports
  60. 2026 Q1: no reports
  61. 2026 Q2: 21 reports
  62. 2026 Q3: 1 report
Dated reports, 2011 Q2 to 2026 Q3.

Techniques in ATT&CK

Listed by ATT&CK

Show all 23 techniques Show fewer

No report from the last two years names a technique ID.

CVEs named in reports

Show all 94 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. PLA Unit 61486

    date ORKL added it fromORKL

  2. Council on Foreign Relations

    date ORKL added it fromORKL

Show all 138 reports Show fewer
  1. Operation Shady RAT

    date ORKL added it fromORKL

  2. Modern Asia APT groups TTPs

    file creation date Kaspersky fromORKL

  3. Advanced Persistent Threats (APTs)

    date in the title fromORKL

  4. Advanced Persistent Threats (APTs)

    date in the title fromORKL

  5. The Art of Cyberwarfare Chinese APTs attack Russia

    date in the title fromORKL

  6. The Art of Cyberwarfare

    date in the CCS '25 data Solar JSOC fromORKLCCS '25 data

  7. Elizabethan England has nothing on modern-day Russia

    date in the title fromORKL

  8. Operation TunnelSnake _ Securelist

    date in the CCS '25 data FireEye fromORKLCCS '25 data

  9. Operation TunnelSnake

    date in the title fromORKL

  10. APT Encounters of the Third Kind

    date in the title fromORKL

  11. CSET - Academics, AI, and APTs

    file creation date fromORKL

  12. A Cyber Threat Intelligence Self-Study Plan- Part 1

    date in the title fromORKL

  13. PowerPoint Presentation

    file creation date Ganesan, Brittany (OS/ASA) (CTR) fromORKL

  14. Reviving MuddyC3 Used by MuddyWater (IRAN) APT

    date in the CCS '25 data Shells.Systems fromORKLCCS '25 data

  15. APT41: A Dual Espionage and Cyber Crime Operation

    file creation date FireEye fromORKL

  16. Analytics

    Malpedia library date fromORKL

  17. Operation-Taskmasters-2019-eng

    date in the CCS '25 data Positive Technologies fromORKLCCS '25 data

  18. report_APT41

    file creation date fromORKL

  19. Operation Soft Cell_ A Worldwide Campaign Against Telecommunications Providers

    date in the CCS '25 data Cybereason fromORKLCCS '25 data

  20. 10 Years Since Ghostnet

    date in the title fromORKL

  21. The Advanced Persistent Threat files- Lazarus Group

    date in the title fromORKL

  22. ‘Operation Oceansalt’ Delivers Wave After Wave

    date in the title fromORKL

  23. BfV Cyber-Brief Nr. 02/2018

    file creation date Bundesamt für Verfassungsschutz fromORKL

  24. BfV Cyber-Brief Nr. 01/2018

    file creation date Bundesamt für Verfassungsschutz fromORKL

  25. The destruction of APT3

    date in the CCS '25 data Intrusiontruth fromORKLCCS '25 data

  26. The destruction of APT3

    date in the title fromORKL

  27. Iran’s Cyber Ecosystem- Who Are the Threat Actors-

    date in the title fromORKL

  28. APT1

    date in the CCS '25 data Mandiant fromCCS '25 data

  29. Iran_Cyber_Final_Full_v2

    file creation date fromORKL

  30. Advanced Persistent Threat Groups

    date in the title fromORKL

  31. Aurora_Operation_CCleaner

    date in the CCS '25 data Cisco fromORKLCCS '25 data

  32. Operation Cloud Hopper

    file creation date fromORKL

  33. cloud-hopper-report-final-upda_72977

    file creation date fromORKL

  34. Operation Cloud Hopper

    date in the CCS '25 data PWC fromORKLCCS '25 data

  35. CS_organisation_CHINA_092016 (1)

    date in the CCS '25 data Mandiant fromORKLCCS '25 data

  36. Bartholomew-GuerreroSaade-VB2016.indd

    Malpedia library date Kaspersky fromORKL

  37. ICIT-Brief-China-Espionage-Dynasty

    date in the CCS '25 data Debra Obyrne fromORKLCCS '25 data

  38. Please Read

    date in the CCS '25 data FireEye and Microsoft fromORKLCCS '25 data

  39. Red Line Drawn: China Recalculates Its Use Of Cyber Espionage

    date in the CCS '25 data FireEye fromORKLCCS '25 data

  40. rpt-china-espionage

    file creation date fromORKL

  41. ib-entertainment.pdf

    file creation date fromORKL

  42. PowerPoint Presentation

    date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

  43. Operation Beebus

    file creation date FireEye fromORKL

  44. Operation Duststorm

    file creation date Cylance fromORKL

  45. The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns

    date in the CCS '25 data Kaspersky fromORKLCCS '25 data

  46. Vinself now with steganography - Airbus D&S CyberSecurity blog

    date in the CCS '25 data Airbus fromORKLCCS '25 data

  47. sec14-paper-blond

    date in the CCS '25 data Symantec fromORKLCCS '25 data

  48. Targeted_Attacks_Lense_NGO

    file creation date fromORKL

  49. Putter Panda

    Malpedia library date Crowdstrike fromORKLCCS '25 data

  50. Snake Campaign & Cyber Espionage Toolkit

    Malpedia library date BAE Systems fromORKLCCS '25 data

  51. A Detailed Examination of the Siesta Campaign

    date in the title fromORKL

  52. Analysis of DHS NCCIC Indicators

    date in the title fromORKL

  53. targeted_attacks_against_the_energy_sector

    date in the CCS '25 data Symantec fromORKLCCS '25 data

  54. CrowdCasts Monthly: You Have an Adversary Problem

    Malpedia library date fromORKL

  55. Shady RAT

    file creation date Vanity Fair fromORKL

  56. Hidden Lynx – Professional Hackers for Hire

    date in the title fromORKL

  57. Hidden Lynx – Professional Hackers for Hire

    Malpedia library date fromORKL

  58. Hidden Lynx: Professional Hackers For Hire

    Malpedia library date Symantec fromORKL

  59. Taleret strings - APT (1)

    date in the title fromORKL

  60. APT1: technical backstage

    Malpedia library date Malware.lu, itrust fromORKL

  61. Comment Crew: Indicators Of Compromise

    file creation date Symantec fromORKL

  62. APT1- Q&A on Attacks by the Comment Crew

    date in the title fromORKL

  63. PLA Unit 61398

    Malpedia library date fromORKL

  64. PLA Unit 61398

    date in the title fromORKL

  65. Mandiant_APT1_Report

    file creation date Mandiant fromORKL

  66. Syrian Electronic Army

    date in the title fromORKL

  67. Alleged Apt Intrusion Set: 1.Php Group

    file creation date Zscaler, ThreatLabz fromORKL

  68. enter-the-cyberdragon

    file creation date fromORKL

  69. The Lurid Downloader

    file creation date Trend Micro fromORKL

  70. CyberEspionage

    file creation date fromORKL

Newest first. Details opens the report in Explore.