CVE Intelligence
Home / Threat actors / APT3

APT3 G0022

🔔 Create alert

Also known as: Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2
associated CVEs
55
Techniques
6
Malware and tools

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2015-3113 Critical · 9.8 KEV Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
“APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.”
CVE-2014-1776 Critical · 9.8 KEV Microsoft Internet Explorer Memory Corruption Vulnerability
“APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.”

Techniques by tactic

Initial Access
T1078.002 Domain AccountsT1566.002 Spearphishing Link
Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1574.001 DLL
Persistence
T1053.005 Scheduled TaskT1078.002 Domain AccountsT1098.007 Additional Local or Domain GroupsT1136.001 Local AccountT1543.003 Windows ServiceT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1078.002 Domain AccountsT1098.007 Additional Local or Domain GroupsT1543.003 Windows ServiceT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027 Obfuscated Files or InformationT1027.002 Software PackingT1027.005 Indicator Removal from ToolsT1036.010 Masquerade Account NameT1070.004 File DeletionT1078.002 Domain AccountsT1218.011 Rundll32T1564.003 Hidden WindowT1574.001 DLL
Credential Access
T1003.001 LSASS MemoryT1056.001 KeyloggingT1110.002 Password CrackingT1552.001 Credentials In FilesT1555.003 Credentials from Web Browsers
Discovery
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069 Permission Groups DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local Account
Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin Shares
Collection
T1005 Data from Local SystemT1056.001 KeyloggingT1074.001 Local Data StagingT1560.001 Archive via Utility
Command and Control
T1090.002 External ProxyT1095 Non-Application Layer ProtocolT1104 Multi-Stage ChannelsT1105 Ingress Tool Transfer
Exfiltration
T1041 Exfiltration Over C2 Channel

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.