MITRE ATT&CKgroup
G0022 APT3
- Domain
- enterprise
- Aliases
- Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110
- Version
- 1.4
- Created
- 2017-05-31
Description
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.
Related
Uses · MITRE ATT&CK (50)
- T1036.010 Masquerade Account Name sub-technique
- T1098.007 Additional Local or Domain Groups sub-technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1090.002 External Proxy sub-technique
- T1074.001 Local Data Staging sub-technique
- T1078.002 Domain Accounts sub-technique
- T1564.003 Hidden Window sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1087.001 Local Account sub-technique
- T1560.001 Archive via Utility sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1003.001 LSASS Memory sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1056.001 Keylogging sub-technique
- T1110.002 Password Cracking sub-technique
- T1027.002 Software Packing sub-technique
- T1552.001 Credentials In Files sub-technique
- T1070.004 File Deletion sub-technique
- T1136.001 Local Account sub-technique
- T1546.008 Accessibility Features sub-technique
- T1218.011 Rundll32 sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1053.005 Scheduled Task sub-technique
- S0349 LaZagne software (tool)
References
- https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html FireEye Clandestine Wolf
- https://www.recordedfuture.com/research/chinese-mss-behind-apt3 Recorded Future APT3 May 2017
- http://pwc.blogs.com/cyber_security_updates/2015/07/pirpi-scanbox.html PWC Pirpi Scanbox
- https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html FireEye Operation Double Tap
- https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong Symantec Buckeye