aol.pm

APT1

IntrusionSet · ATTACK:enterprise:G0006

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0006",
  "title": "APT1",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0006",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662",
  "external_id": "G0006",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:47.955Z",
  "modified": "2026-07-31T18:47:59.697Z",
  "version": "1.4",
  "aliases": [
    "APT1",
    "Comment Crew",
    "Comment Group",
    "Comment Panda"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "APT1"
    },
    {
      "source_name": "Comment Crew"
    },
    {
      "source_name": "Comment Group"
    },
    {
      "source_name": "Comment Panda"
    },
    {
      "source_name": "Mandiant APT1",
      "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
    },
    {
      "source_name": "CrowdStrike Putter Panda",
      "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
    }
  ]
}

Explicit source assertions (40)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0345

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e6d6b87-84fe-49ed-9b85-cf3cdfa36820

Mandiant APT1 Appendix · McAfee Oceansalt Oct 2018

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0100

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13984eec-6c33-4bab-a22c-5c061ddd6e44

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0017

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19fce62c-ba70-4c20-bf74-0bca7886190c

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d5e0da2-7741-4a31-9c54-cbbe584fe27b

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28b27852-4125-4639-a07b-0b97dfdb650a

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d0afb20-dfbd-4f6b-bd75-ee67d8eeb8c6

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0026

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--324a5331-cce7-4154-a803-ad68d5de1f94

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38416e2a-3590-4827-9a6f-d8f1df6568af

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38a72b32-dc04-493d-8b92-31174c32f3ed

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b35fec9-ee0d-4c2d-9936-0aa06ad6a49a

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40e49390-e8a5-4d91-8ec9-d05fb3b71149

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43c34939-8236-4ddd-8def-0eb7b5fe62cf

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0121

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44858dc2-c869-42a0-8f67-3ddd9660b538

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47545d87-b0ae-45ae-aeea-dc849eac2f6f

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0109

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a687e50-e6b7-41df-93b1-6fed7db10f60

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c2924c1-dec5-4390-87d7-c52e24a92512

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4eb5fba5-be97-4103-9b52-f77e02765fad

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bc68652-1d99-4782-80bd-086fc7f8358c

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--630dedba-136b-4ea3-956e-f8f38e96653d

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--635c959b-acf4-464a-a240-f299f5fea753

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e366a30-cf75-4a47-855f-91a006014ada

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--757bed64-558b-4ea7-84b9-b82d8b23f9b2

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0122

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76393f0c-a13c-48a8-ba7d-80502ae938a7

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7909f5a6-3924-4259-aedd-2e48123f563a

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79cd2ec8-068c-4a7a-8133-1855381d3bd3

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b817a81-02a9-48f0-8166-9e25b6860a76

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--886942af-c1e9-49e9-af7e-98d1899f3000

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b14bfc1-2c78-4ec9-ad02-aeed6f1cf83e

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6f70ba6-bff1-4b40-a418-356e7b6efa27

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1584.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1c2c530-a2d2-4c2f-bcff-ceda0277de59

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7823efd-005f-49ad-94cf-ebc44a87abed

Mandiant APT1 Appendix · Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf467be5-c162-4763-801b-32cb57a514ef

Mandiant APT1 Appendix

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d014d8e1-b12e-4b85-84ee-ff4338c54393

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de4ae50a-0561-4d01-885a-eab60008d5eb

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de979692-5ca5-4874-bfc8-91cea8697ef1

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e07b76a4-98d7-4adc-b90e-a1f7f2266867

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea40711b-461d-4629-b1fd-5f020b1f3257

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f55814a0-9e57-4bf3-bc40-21e7d3fca230

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9c7127d-2a27-4dcf-bef5-9150a6c4334d

Mandiant APT1

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc2ffb01-2c4e-429d-b4fd-e0d20678504a

FireEye PLA

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.