MITRE ATT&CK G0006
PLA Unit 61398
View MITRE Group Page ↗
Aliases: APT1, Comment Crew, TG-8223
Official Attribution Source: U.S. Department of Justice Indictment (W.D. Pa., May 2014)
Key Facts
Jurisdiction
People's Republic of China
Geographic origin
Cases
1
Prosecution matters
Defendants
2
Indicted individuals
Sanctions
0
OFAC designations
- Attributed Country: People's Republic of China.
- ATT&CK Group Reference: G0006 (PLA Unit 61398).
- Linked to 1 primary court prosecution record(s) with $100.0 million documented loss.
- Identified 2 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1566.001 Spearphishing Attachment | 1 incidents |
| T1041 Exfiltration Over C2 Channel | 1 incidents |
Prosecution Cases Attributed to PLA Unit 61398
U.S. v. Sun Kailiang et al. (PLA Unit 61398 / APT1)
fugitive 2014-05-01
Historic first-ever criminal indictment against state military actors: five Chinese military officers in People's Liberation Army Unit 61398 charged with cyber espionage against Westinghouse, U.S. Steel, Alcoa, and the United Steelworkers union.
Primary Attack Mechanism: Adversary gained initial access via Spearphishing Attachment: Defendants sent spearphishing emails containing malicious attachments to corporate engineers, appearing to come from colleagues or trade groups.
2 techniques mapped · Loss: $100.0 million
View full case dossier →
Indicted Operatives & Dispositions (2)
Sun Kailiang fugitive
PLA Unit 61398 military officer indicted in W.D. Pa. for economic cyber espionage.
Sentence: Pending / None
Wang Dong fugitive
PLA Unit 61398 hacker indicted for intruding into U.S. commercial energy and manufacturing networks.
Sentence: Pending / None