APT3

G0022 China Espionage MITRE ATT&CK →

Also known as: Gothic Panda · Pirpi · UPS Team · Buckeye · Threat Group-0110 · TG-0110

Overview

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

Targets

Political party · Private sector

Regions

Hong Kong · United Kingdom · United States

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1203
Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 44 techniques across 11 tactics

Command and Control

Exfiltration

T1041 Exfiltration Over C2 Channel

Tools & malware (6)

OSInfo · schtasks · PlugX · LaZagne · SHOTPUT · RemoteCMD

Reporting (3)

(2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3 — Insikt Group (Recorded Future)
Buckeye cyberespionage group shifts gaze from US to Hong Kong — Symantec Security Response
A tale of Pirpi, Scanbox & CVE-2015-3113 — Lancaster, T

Overview

Targets

Regions

Capabilities

TTPs — 44 techniques across 11 tactics

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Tools & malware (6)

Reporting (3)