auren-research/cyber-sec huggingface dataset:
modified: 2024-12-02T22:01:07.830Z
name: ShadowRay
description: [ShadowRay](https://attack.mitre.org/campaigns/C0045) was a campaign that began in late 2023 targeting the education, cryptocurrency, biopharma, and other sectors through a vulnerability (CVE-2023-48022) in the Ray AI framework named ShadowRay. According to security researchers [ShadowRay](https://attack.mitre.org/campaigns/C0045) was the first known instance of AI workloads being activley exploited in the wild through vulnerabilities in AI infrastructure. CVE-2023-48022, which allows access to compute resources and sensitive data for exposed instances, remains unpatched and has been disputed by the vendor as they maintain that Ray is not intended for use outside of a strictly controlled network environment.(Citation: Oligo ShadowRay Campaign MAR 2024)
aliases: ShadowRay
first_seen: 2023-09-01T04:00:00.000Z
last_seen: 2024-03-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Oligo ShadowRay Campaign MAR 2024)
x_mitre_last_seen_citation: (Citation: Oligo ShadowRay Campaign MAR 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Shun Miyazaki, NEC Corporation
Sareena Karapoola, NEC Corporation India
Pooja Natarajan, NEC Corporation India
type: campaign
spec_version: 2.1
id: campaign--57899965-b171-48ed-bbb4-8faffa3d836a
created: 2024-12-02T19:35:14.473Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0045
external_id: C0045
source_name: Oligo ShadowRay Campaign MAR 2024
description: Lumelsly, A. et al. (2024, March 26). ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild. Retrieved December 2, 2024.
url: https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--a0cb9370-e39b-44d5-9f50-ef78e412b973
created: 2017-05-31T21:31:45.629Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0001
external_id: G0001
source_name: Group 72
description: (Citation: Cisco Group 72)
source_name: Axiom
description: (Citation: Novetta-Axiom)
source_name: Cisco Group 72
description: Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.
url: http://blogs.cisco.com/security/talos/threat-spotlight-group-72
source_name: Kaspersky Winnti April 2013
description: Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
url: https://securelist.com/winnti-more-than-just-a-game/37029/
source_name: Novetta Winnti April 2015
description: Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
url: https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf
source_name: Novetta-Axiom
description: Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
url: https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
source_name: Kaspersky Winnti June 2015
description: Tarakanov, D. (2015, June 22). Games are over: Winnti is now targeting pharmaceutical companies. Retrieved January 14, 2016.
url: https://securelist.com/games-are-over/70991/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:36.790Z
name: Axiom
description: [Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between [Axiom](https://attack.mitre.org/groups/G0001) and [Winnti Group](https://attack.mitre.org/groups/G0044) but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)
aliases: Axiom
Group 72
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-04-11T02:42:07.325Z
name: Dark Caracal
description: [Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. (Citation: Lookout Dark Caracal Jan 2018)
aliases: Dark Caracal
x_mitre_deprecated: no
x_mitre_version: 1.4
type: intrusion-set
spec_version: 2.1
id: intrusion-set--8a831aaa-f3e0-47a3-bed8-a9ced744dd12
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0070
external_id: G0070
source_name: Dark Caracal
description: (Citation: Lookout Dark Caracal Jan 2018)
source_name: Lookout Dark Caracal Jan 2018
description: Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
url: https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
mobile-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fed4f0a2-4347-4530-b0f5-6dfd49b29172
created: 2021-08-24T17:04:27.002Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0133
external_id: G0133
source_name: DustSquad
description: (Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: SecurityWeek Nomadic Octopus Oct 2018)
source_name: Nomadic Octopus
description: (Citation: SecurityWeek Nomadic Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
source_name: ESET Nomadic Octopus 2018
description: Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.
url: https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf
source_name: Securelist Octopus Oct 2018
description: Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.
url: https://securelist.com/octopus-infested-seas-of-central-asia/88200/
source_name: SecurityWeek Nomadic Octopus Oct 2018
description: Kovacs, E. (2018, October 18). Russia-Linked Hackers Target Diplomatic Entities in Central Asia. Retrieved October 13, 2021.
url: https://www.securityweek.com/russia-linked-hackers-target-diplomatic-entities-central-asia
source_name: Security Affairs DustSquad Oct 2018
description: Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.
url: https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:36.955Z
name: Nomadic Octopus
description: 
[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://attack.mitre.org/groups/G0133) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
aliases: Nomadic Octopus
DustSquad
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb
created: 2017-05-31T21:31:47.537Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0005
external_id: G0005
source_name: APT12
description: (Citation: Meyers Numbered Panda) (Citation: Moran 2014)
source_name: IXESHE
description: (Citation: Meyers Numbered Panda) (Citation: Moran 2014)
source_name: DynCalc
description: (Citation: Meyers Numbered Panda) (Citation: Moran 2014)
source_name: Numbered Panda
description: (Citation: Meyers Numbered Panda)
source_name: DNSCALC
description: (Citation: Moran 2014)
source_name: Meyers Numbered Panda
description: Meyers, A. (2013, March 29). Whois Numbered Panda. Retrieved January 14, 2016.
url: http://www.crowdstrike.com/blog/whois-numbered-panda/
source_name: Moran 2014
description: Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September 3). Darwin’s Favorite APT Group [Blog]. Retrieved November 12, 2014.
url: https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:18.305Z
name: APT12
description: [APT12](https://attack.mitre.org/groups/G0005) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)
aliases: APT12
IXESHE
DynCalc
Numbered Panda
DNSCALC
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.1
x_mitre_attack_spec_version: 3.2.0
modified: 2024-11-17T16:43:16.049Z
name: Putter Panda
description: [Putter Panda](https://attack.mitre.org/groups/G0024) is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)
aliases: Putter Panda
APT2
MSUpdater
x_mitre_deprecated: no
x_mitre_version: 1.2
type: intrusion-set
spec_version: 2.1
id: intrusion-set--5ce5392a-3a6c-4e07-9df3-9b6a9159ac45
created: 2017-05-31T21:31:56.785Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0024
external_id: G0024
source_name: MSUpdater
description: (Citation: CrowdStrike Putter Panda)
source_name: Putter Panda
description: (Citation: CrowdStrike Putter Panda) (Citation: Cylance Putter Panda)
source_name: APT2
description: (Citation: Cylance Putter Panda)
source_name: CrowdStrike Putter Panda
description: Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
url: http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf
source_name: Cylance Putter Panda
description: Gross, J. and Walter, J.. (2016, January 12). Puttering into the Future.... Retrieved November 17, 2024.
url: https://blogs.blackberry.com/en/2016/01/puttering-into-the-future
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T00:46:59.526Z
name: Metador
description: [Metador](https://attack.mitre.org/groups/G1013) is a suspected cyber espionage group that was first reported in September 2022. [Metador](https://attack.mitre.org/groups/G1013) has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group [Metador](https://attack.mitre.org/groups/G1013) based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.(Citation: SentinelLabs Metador Sept 2022)
aliases: Metador
x_mitre_deprecated: no
x_mitre_version: 1.1
x_mitre_contributors: Massimiliano Romano, BT Security
Sittikorn Sangrattanapitak
type: intrusion-set
spec_version: 2.1
id: intrusion-set--bfc5ddb3-4dfb-4278-8928-020e1b3feddd
created: 2023-01-25T23:57:51.818Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1013
external_id: G1013
source_name: SentinelLabs Metador Sept 2022
description: Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
url: https://assets.sentinelone.com/sentinellabs22/metador#page=1
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-01-15T23:25:55.678Z
name: Operation MidnightEclipse
description: [Operation MidnightEclipse](https://attack.mitre.org/campaigns/C0048) was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)
aliases: Operation MidnightEclipse
first_seen: 2024-03-01T05:00:00.000Z
last_seen: 2024-04-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: Volexity UPSTYLE 2024)
x_mitre_last_seen_citation: (Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--455b011a-2510-49ab-a96f-2f84d6a80189
created: 2025-01-15T19:56:55.070Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0048
external_id: C0048
source_name: Palo Alto MidnightEclipse APR 2024
description: Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.
url: https://unit42.paloaltonetworks.com/cve-2024-3400/
source_name: Volexity UPSTYLE 2024
description: Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.
url: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--62a64fd3-aaf7-4d09-a375-d6f8bb118481
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0062
external_id: G0062
source_name: TA459
description: (Citation: Proofpoint TA459 April 2017)
source_name: Proofpoint TA459 April 2017
description: Axel F. (2017, April 27). APT Targets Financial Analysts with CVE-2017-0199. Retrieved February 15, 2018.
url: https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:19.743Z
name: TA459
description: [TA459](https://attack.mitre.org/groups/G0062) is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)
aliases: TA459
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Valerii Marchuk, Cybersecurity Help s.r.o.
modified: 2024-04-15T21:10:00.969Z
name: C0032
description: [C0032](https://attack.mitre.org/campaigns/C0032) was an extended campaign suspected to involve the [Triton](https://attack.mitre.org/software/S1009) adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030).(Citation: FireEye TRITON 2019)
aliases: C0032
first_seen: 2014-10-01T04:00:00.000Z
last_seen: 2017-01-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: FireEye TRITON 2019)
x_mitre_last_seen_citation: (Citation: FireEye TRITON 2019)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--7ec2826c-0bf0-4b47-acae-fd683431a4ca
created: 2024-03-28T15:22:19.075Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0032
external_id: C0032
source_name: FireEye TRITON 2019
description: Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.
url: https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--4283ae19-69c7-4347-a35e-b56f08eb660b
created: 2021-03-24T15:48:17.731Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0128
external_id: G0128
source_name: APT31
description: (Citation: Check Point APT31 February 2021)
source_name: Violet Typhoon
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Microsoft Targeting Elections September 2020
description: Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.
url: https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/
source_name: Check Point APT31 February 2021
description: Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.
url: https://research.checkpoint.com/2021/the-story-of-jian/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-15T20:39:25.843Z
name: ZIRCONIUM
description: [ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.(Citation: Microsoft Targeting Elections September 2020)(Citation: Check Point APT31 February 2021)
aliases: ZIRCONIUM
APT31
Violet Typhoon
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 2.3
x_mitre_attack_spec_version: 3.3.0
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662
created: 2017-05-31T21:31:47.955Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0006
external_id: G0006
source_name: APT1
description: (Citation: Mandiant APT1)
source_name: Comment Crew
description: (Citation: Mandiant APT1)
source_name: Comment Group
description: (Citation: Mandiant APT1)
source_name: Comment Panda
description: (Citation: CrowdStrike Putter Panda)
source_name: Mandiant APT1
description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
source_name: CrowdStrike Putter Panda
description: Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
url: http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:20.672Z
name: APT1
description: [APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)
aliases: APT1
Comment Crew
Comment Group
Comment Panda
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_attack_spec_version: 3.2.0