FORENSIA

THREAT_ACTOR · G0022

APT3

Also known as: APT3, Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110

Profile

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

MITRE ATT&CK ↗

Techniques

44 ATT&CK techniques attributed to this actor.

T1003.001 LSASS MemoryT1005 Data from Local SystemT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1027 Obfuscated Files or InformationT1027.002 Software PackingT1027.005 Indicator Removal from ToolsT1033 System Owner/User DiscoveryT1036.010 Masquerade Account NameT1041 Exfiltration Over C2 ChannelT1049 System Network Connections DiscoveryT1053.005 Scheduled TaskT1056.001 KeyloggingT1057 Process DiscoveryT1059.001 PowerShellT1059.003 Windows Command ShellT1069 Permission Groups DiscoveryT1070.004 File DeletionT1074.001 Local Data StagingT1078.002 Domain AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1090.002 External ProxyT1095 Non-Application Layer ProtocolT1098.007 Additional Local or Domain GroupsT1104 Multi-Stage ChannelsT1105 Ingress Tool TransferT1110.002 Password CrackingT1136.001 Local AccountT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1218.011 Rundll32T1543.003 Windows ServiceT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup FolderT1552.001 Credentials In FilesT1555.003 Credentials from Web BrowsersT1560.001 Archive via UtilityT1564.003 Hidden WindowT1566.002 Spearphishing LinkT1574.001 DLL

Software

6 malware/tools attributed to this actor.

PlugXSHOTPUTschtasksOSInfoRemoteCMDLaZagne

Related corpus activity

10,083 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to APT3.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2013-3307cve—852
cve-2014-2321cve—851
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2025-66478cve—852
cve-2021-27076cve—851
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2022-47945cve—851
cve-2016-5681cve—852
cve-2025-0921cve—852
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2023-44976cveransomware852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,083.