APT3

MITRE ATT&CK: G0022 View on attack.mitre.org

Aliases: Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110, GOTHIC PANDA, Group 6, UPS, Boyusec, BORON, BRONZE MAYFAIR, Red Sylvan, Brocade Typhoon, APT3, OLDCARP, CYBRAN

First seen
2010-01-01 00:00:00
Origin
CN
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
Espionage
Related IoCs
3
Last IoC activity
2026-04-01 00:06:15
Profile updated
2026-07-07 12:31:59

Targeted industries: government-and-public-sector technology-and-telecommunications financial-services defense-and-aerospace

Targeted regions: country_code:us country_code:hk

Context

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

Detection coverage

  • 12 YARA rules
  • 973 Sigma rules

Malware & tools used

  • Scheduled Task (attack-pattern)
  • Multi-Stage Channels (attack-pattern)
  • Password Cracking (attack-pattern)
  • Hidden Window (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • External Proxy (attack-pattern)
  • Rundll32 (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Additional Local or Domain Groups (attack-pattern)
  • Malicious Link (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Domain Accounts (attack-pattern)
  • Data from Local System (attack-pattern)
  • Exploitation for Client Execution (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • DLL (attack-pattern)
  • Local Account (attack-pattern)
  • File Deletion (attack-pattern)
  • File and Directory Discovery (attack-pattern)

Reports & references

  • Mandiant — Apt Groups (report)
  • Mandiant — Cds19 Executive S08 Achievement Unlocked (report)
  • Mandiant — Operation Clandestine Wolf Adobe Flash Zero Day (report)
  • web.archive.org — Buckeye Cyberespionage Group Shifts Gaze Us Hong Kong (report)
  • cfr.org — Apt 3 (report)
  • secureworks.com — Bronze Mayfair (report)
  • raw.githubusercontent.com — Microsoftmapping (report)
  • pwc.blogs.com — Pirpi Scanbox (report)
  • MITRE ATT&CK — G0022 (report)
  • Mandiant — Operation Doubletap (report)
  • recordedfuture.com — Chinese Mss Behind Apt3 (report)

External references