The APT Files #1: The Comment Crew

Hacking Panda ¦ Credit: Author using Stable Diffusion

To Non-members of Medium, use this link.

Quick Details

Suspected Origin: China, 2006

Other Names: Unit 61398, Byzantine Hades, Comment Panda, GIF89a, Brown Fox

Target Region(s): Eastern Asia, North America

Attack Vectors: Spearphishing, Data theft

Tools observed: Poison Ivy, Mimikatz exploit tool, SeaSalt, Ecltys, Downbot, Barkiofork, AURIGA, BANGAT, OceanSalt

Hacker Words

• Command and Control Server — A computer used to control malware
• Function calls — A command in a program to run a specific task
• Spear-phishing — A specially crafted email to trick a specific person
• Threat group — A group of hackers that work together
• Macro — An automated input sequence that imitates keystrokes or mouse actions
• PHP — A programming language used to create web pages
• Portable Executable — A Windows Executable that is highly compatible on various platforms

The Comment Crew is a threat group suspected to be the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department in China (Trust me, it was…