APT1: The Persistent Data Hoarder — How a PLA Unit Stole Hundreds of Terabytes and Changed Cyber Threat Intelligence Forever

The group that defined the threat intelligence industry.

APT1 — also known as the Comment Crew, Comment Group, Comment Panda, Byzantine Candor, Shanghai Group, and TG-8223 — is a Chinese state-sponsored cyber espionage group attributed to the 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's 3rd Department, identified by its Military Unit Cover Designator (MUCD) as Unit 61398. Operating from a 12-storey building off Datong Road in the Pudong New Area of Shanghai, APT1 conducted what Mandiant described as 'a multi-year, enterprise-scale computer espionage campaign' — systematically stealing hundreds of terabytes of intellectual property from at least 141 organisations across 20 major industries since 2006.

APT1 is not just another threat actor profile. It is the threat actor that created the threat intelligence industry as we know it. Mandiant's February 2013 report — APT1: Exposing One of China's Cyber Espionage Units — was the first time a private security firm publicly attributed a sustained cyber espionage campaign directly to a specific military unit of a nation state, named individual operators, traced activity to physical buildings and IP addresses, and released over 3,000 indicators of compromise to enable global defence. The report forced the US government to act, leading to the unprecedented 2014 indictment of five PLA officers by the Department of Justice. Every threat intelligence report published since — including the profiles on this blog — follows the template that Mandiant established with APT1.

The name 'Comment Crew' derives from the group's signature technique: their WEBC2 backdoors retrieved commands hidden within HTML comment tags on attacker-controlled web pages. The malware would request a seemingly ordinary web page, then parse the HTML comments for encoded instructions. It was an elegant, stealthy approach — HTTP requests to web pages blend perfectly with normal internet traffic, and the commands themselves were invisible to anyone casually viewing the page source.

From IP addresses to a 12-storey building in Shanghai.

141 victims. 20 industries. Hundreds of terabytes.

The scale of APT1's operations is what earned them the title of 'persistent data hoarder'. Unlike threat actors who breach a target, steal what they need, and leave, APT1 maintained access to victim networks for months or years, continuously stealing broad categories of intellectual property. They did not exfiltrate targeted documents — they hoarded everything.

The figure of 6.5 terabytes stolen from a single organisation over ten months deserves emphasis. That is not a targeted extraction of specific files — it is the wholesale copying of an organisation's intellectual capital. Technology blueprints, proprietary manufacturing processes, business plans, pricing documents, negotiation strategies, test results, partnership agreements, emails, and contact lists — APT1 took everything of potential value and continued taking it for as long as they had access.

Twenty industries aligned with China's strategic priorities.

APT1's targeting was not random. The 20 industries they compromised align precisely with China's strategic economic development priorities — sectors where stolen intellectual property would directly accelerate Chinese industrial capability and reduce dependency on foreign technology.

Additional sectors compromised include: navigation, mining, construction, agriculture, food, healthcare, education, media, government, and legal services. The breadth is remarkable — APT1 was not a specialist unit targeting a single sector but an industrial-scale intelligence collection operation serving China's comprehensive economic development agenda. The 141 confirmed victims span North America, Europe, Asia-Pacific, the Middle East, and parts of Africa, with the heaviest concentration in the United States.

Hiding commands in HTML comments.

APT1's signature WEBC2 backdoor family is the reason the group became known as the Comment Crew. The technique is deceptively simple but was remarkably effective for nearly a decade.

Mandiant observed APT1 operators logging into WEBC2 C2 servers and manually editing the HTML files that backdoors would download. Because the encoded commands were difficult to type from memory, operators typically copied and pasted command strings into the HTML files — a small operational detail captured by Mandiant's monitoring that reinforced the human nature of the threat: these were individuals at keyboards, working shifts, making mistakes, following procedures.

40+ malware families — a military arsenal.

From spear-phish to years of continuous theft.

APT1's attack lifecycle was methodical and disciplined — a well-defined methodology honed over years and designed to steal large volumes of data from many organisations simultaneously. Unlike sophisticated threat actors who delete traces after their mission, APT1 maintained access and continued stealing for as long as possible.

UglyGorilla, SuperHard, and DOTA — the humans behind the keyboards.

One of Mandiant's most impactful decisions was to identify individual APT1 operators — demonstrating that state-sponsored cyber espionage is conducted by real people who make mistakes, leave traces, and can be identified. Three personas were publicly attributed in the original report.

FireEye later confirmed the DOJ's findings, noting that APT1's intrusion activity followed an '8:00 AM to 5:00 PM' work-day pattern aligned with Shanghai business hours — reinforcing that these operators worked regular shifts in an office environment, not from personal computers. They were military personnel conducting assigned duties.

The report that changed everything.

The Mandiant APT1 report triggered a cascade of consequences that reshaped international cybersecurity policy, the threat intelligence industry, and US-China relations.

APT1 in context — one unit among many.

APT1 was the most prolific PRC cyber espionage group in terms of sheer data volume, but it was one unit within a much larger ecosystem. Understanding APT1's role requires placing it alongside the other PRC-linked groups that operate with different mandates, target sets, and techniques.

What APT1 still teaches us — over a decade later.

The bottom line.

APT1 was the most prolific data thief in the history of documented cyber espionage. Operating as PLA Unit 61398 from a 12-storey building in Shanghai's Pudong district, the group systematically compromised 141 organisations across 20 industries, stealing hundreds of terabytes of intellectual property over a period of at least seven years. Their longest known operation maintained persistent access to a single victim network for nearly five years. Their largest documented single-victim theft was 6.5 terabytes in ten months. They operated at industrial scale, compromising dozens of organisations simultaneously, supported by hundreds of personnel and a purpose-built fibre-optic network.

Mandiant's 2013 report exposing APT1 remains the single most consequential publication in the history of cyber threat intelligence. It demonstrated that a private-sector firm could attribute state-sponsored espionage to a specific military unit, name individual operators, and release actionable intelligence to the global defender community. The report led to the first-ever criminal indictment of foreign military officials for cyber espionage, a bilateral agreement between the US and Chinese presidents, and the birth of the commercial threat intelligence industry. Every threat actor profile, every APT report, every IOC-sharing platform that exists today traces its lineage to Mandiant's decision to publish.

APT1 is no longer active in its original form. But the lessons it teaches are as relevant today as they were in 2013. Dwell time, not initial access, is where the damage accumulates. Spear-phishing remains the primary vector. Attackers use your own tools against you. Data hoarding means everything accessible will be stolen. And the threat actors never really disappear — they restructure, retool, and return under different names with better operational security. The defenders who remember APT1's lessons are better prepared for what comes next.