Skip to content
Nation-state APTEspionageAdvanced sophistication · State-backed

APT1

APT1 is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 18 countries, including the United States and the United Kingdom. It uses 32 MITRE ATT&CK techniques and exploits 1 known CVE.

Also known as
  • Comment Crew
  • Comment Group
  • Comment Panda
  • Brown Fox
  • GIF89a
  • TG-8223
  • Group 3
  • Byzantine Hades
  • Byzantine Candor
  • Shanghai Group
  • G0006
  • Operation “Seasalt”
  • Operation “Siesta”
  • Operation “Oceansalt”
Origin
China
Techniques
32
Exploited CVEs
1
First seen
Jan 1, 2006
Last seen
Feb 19, 2013
Record updated

Who They Target.

Labelsespionageglobal

About APT1.

APT1 has been active since at least 2006. APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.

Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.