APT1__2013__Mandiant_APT1_Report.pdf

This Mandiant report exposes and attributes the activities of APT1 (linked to PLA Unit 61398), documenting a persistent, organized Chinese cyber-espionage campaign active since at least 2006 that compromised at least 141 organizations across ~20 industries, stole hundreds of terabytes of intellectual property, used a large global command-and-control and hop infrastructure (centred on Shanghai), developed and operated numerous custom malware families and utilities (e.g., WEBC2, GETMAIL, MAPIGET), and includes operator personas, infrastructure mappings, and over 3,000 Indicators of Compromise to aid detection and remediation.