rkhunter and found out a warning, that there is a new user called
_apt on my Ubuntu 16.04
$ grep _apt /etc/passwd _apt:x:124:65534::/nonexistent:/bin/false
All I found out is, that it seems that this is a kind of sandbox user for "advanced persistent threats". But what exactly is this?