APT1: The Case That Redefined Threat Intelligence

Never forget when the APT1 report came out in 2013.

There was a time, in the early days of hacking, when this activity was attributed to lone experts acting for fame, curiosity, the desire to test their skills and of course, sometimes for money.

Back then, hacking felt almost like a competition of talent. Certain names emerged that shaped the history of the field and even defined what the term “hacker” meant.

Then came the first groups, the first collectives. Later, the first organized criminal structures. From there, the step toward the first Advanced Persistent Threats was surprisingly short.

The hacker was no longer just a skilled individual driven by the challenge of breaking a system to prove talent and ingenuity. A silent but relentless evolution transformed that figure into something else into part of government structures, intelligence offices, and espionage agencies.

Cyber warfare became, in many ways, the ideal war in peacetime.

Then Mandiant published a report that marked a clear turning point, no speculation anymore. With that report, everything was put in black and white. They listed the infrastructure. They mapped the behaviors. They connected the dots and, for the first time, clearly identified a specific military unit: PLA Unit 61398 in Pudong, Shanghai.

Suddenly, it wasn’t just about hackers anymore in fact cybersecurity had entered the era of APTs.

The numbers were significant:

• 141 companies breached

• 20 industries affected

• Attacks dating back to 2006

• Hundreds of terabytes of data stolen

• An average dwell time of 356 days

• In some cases, nearly 5 years of access

  
  

Five years of sustained access inside infrastructures with the highest levels of security. Anyone who has worked in incident response knows how difficult it is to remain undetected for that long.

And the attack infrastructure? Huge, hundreds of command-and-control servers. Thousands of domains. IP addresses traced directly back to Shanghai. Even seemingly small details like the fact that 97% of sessions used a Simplified Chinese keyboard layout added weight to the picture.

From the era of small-scale, almost artisanal hacking, we had moved into the industrial age of large-scale Chinese cyber espionage.

Taken individually, none of these elements were definitive proof. Together, they told a story.

What struck many of us wasn’t just the scale of the operation, but its level of organization.

APT1 followed a precise script:

• Targeted spear phishing

• Custom backdoors (WEBC2, BISCUIT)

• Step-by-step lateral movement

• Privilege escalation

• Data exfiltration through password-protected archives

• International hop points to obscure the trail

  
  

This was not the chaotic image of improvised hacking that many people imagined. It was a team following operational procedures.

Before that, talking about state actors was vague. After that report, everything became tangible. No longer the generic “nation-state,” but a physical building, a specific unit, and an organized system behind it.

Looking back, that realization still holds true.

More than ten years later, things have changed or rather, evolved. At the time, the report shocked everyone. Today, cyber competition between major powers is a given, it is embedded in national strategies. When a new campaign is linked to a state actor, no one is surprised anymore.

Threat actors learned from APT1’s exposure. Attribution today is deliberately more difficult. But one thing has not changed: persistence remains the primary objective.

Even with advanced EDR and XDR systems, sophisticated groups prefer to stay inside quietly rather than make noise. Remaining invisible is more valuable than launching a spectacular attack.

Why APT1 Still Matters

APT1 is not just a story from the past. It is a turning point.

It was the moment when we understood that cyber espionage was not a series of isolated incidents. It was a system organized, repeatable, aligned with broader strategic goals.

Today, this seems obvious. In 2013, it was a wake-up call.

The question is no longer whether states conduct cyber espionage. We know they do.

The real question is: how deeply are these operations woven into economic policy, technological development, and long-term strategic planning?

APT1 was not just a hacking group.

It was the signal that cyberspace had become a permanent battlefiel, the fifth domain.