Malware is a key weapon for APT attackers, which cause huge losses and damages in cyberspace. To effectively classify real-world APT malware, we propose a method that combines prior knowledge features with AutoML. We apply graph pattern clustering to analyze the community structure of threat actor groups and conduct a hierarchical classification based on these communities. Our model incorporates real-world APT samples autonomously collected from open-source intelligence and analyzes the multidimensional impact on the classification of threat actor groups. We obtain an average AUC score of 98.6% on a real-world imbalanced dataset with 20,127 malware instances from 68 threat actor groups. Moreover, it substantially enhances the categorization performance, attaining an average accuracy of 87.4% and a notable 9.72% increase in the Macro-F1 score in the community-based hierarchical model. By leveraging AutoML and graph pattern clustering, we efficiently categorize malware to deepen the understanding of threat actor groups.