Skip to content

APT3

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

ATT&CK ID: G0022
Origin: China
Techniques: 40
Tools: 6

Also tracked as Gothic Panda · Pirpi · UPS Team · Buckeye · Threat Group-0110 · TG-0110

Vulnerabilities it has exploited

Techniques

Initial Access

Valid Accounts Phishing

Execution

Scheduled Task/Job Command and Scripting Interpreter Exploitation for Client Execution User Execution Hijack Execution Flow

Persistence

Scheduled Task/Job Valid Accounts Account Manipulation Create Account Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Valid Accounts Account Manipulation Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Indicator Removal Valid Accounts System Binary Proxy Execution Hide Artifacts Hijack Execution Flow

Credential Access

OS Credential Dumping Input Capture Brute Force Unsecured Credentials Credentials from Password Stores

Discovery

System Network Configuration Discovery Remote System Discovery System Owner/User Discovery System Network Connections Discovery Process Discovery Permission Groups Discovery System Information Discovery File and Directory Discovery Account Discovery

Lateral Movement

Remote Services

Collection

Data from Local System Input Capture Data Staged Archive Collected Data

Command and Control

Proxy Non-Application Layer Protocol Multi-Stage Channels Ingress Tool Transfer

Exfiltration

Exfiltration Over C2 Channel

Software

LaZagne · OSInfo · PlugX · RemoteCMD · SHOTPUT · schtasks

MITRE ATT&CK All threat actors