Threat Intelligence Tarot
Major Arcana · 5
China (PLA Unit 61398)
G0006★★★★★
risk 4/5
✦ The Archivist ✦
APT1
Comment Crew · Comment Panda · Shanghai Group · Unit 61398
AerospaceEnergyTelecommunicationsIT20 identified industries
Active since ~2006 · Intellectual property theft, Economic espionage, Strategic intelligence
It does not want power. It wants knowledge - specifically, your knowledge. Blueprints, contracts, research data: The Archivist catalogs and carries everything across the Pacific for the benefit of state industry.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Mandiant APT1 report exposure (2013)
- ◆Theft of F-35 design documents
- ◆Dual-use technology exfiltration campaign
- ◆Hundreds of terabytes stolen over years
Defenses
- ▸Data Loss Prevention (DLP) on egress channelsCIS Control 13 ↗
- ▸Classification and tagging of sensitive IPNIST CSF: PR.DS ↗
- ▸Outbound traffic inspection and proxy enforcementCIS Control 9 ↗
- ▸Insider threat and data exfiltration behavioral monitoringNIST CSF: DE.CM ↗
Reversed: Their Weakness
The 2013 Mandiant report named APT1's operators by name, photographed their building, and published their real-person identities. Exposure forced a years-long operational pause.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.