APT3 G0022

Também conhecido como: Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

CVEs associadas

Técnicas

Malwares e ferramentas

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2015-3113 Crítica · 9.8 KEV Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

“APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.”

CVE-2014-1776 Crítica · 9.8 KEV Microsoft Internet Explorer Memory Corruption Vulnerability

“APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.”

Técnicas por tática

Acesso inicial

T1078.002 Domain Accounts T1566.002 Spearphishing Link

Execução

T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1203 Exploitation for Client Execution T1204.001 Malicious Link T1574.001 DLL

Persistência

T1053.005 Scheduled Task T1078.002 Domain Accounts T1098.007 Additional Local or Domain Groups T1136.001 Local Account T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1078.002 Domain Accounts T1098.007 Additional Local or Domain Groups T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027 Obfuscated Files or Information T1027.002 Software Packing T1027.005 Indicator Removal from Tools T1036.010 Masquerade Account Name T1070.004 File Deletion T1078.002 Domain Accounts T1218.011 Rundll32 T1564.003 Hidden Window T1574.001 DLL

Acesso a credenciais

T1003.001 LSASS Memory T1056.001 Keylogging T1110.002 Password Cracking T1552.001 Credentials In Files T1555.003 Credentials from Web Browsers

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069 Permission Groups Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares

Coleta

T1005 Data from Local System T1056.001 Keylogging T1074.001 Local Data Staging T1560.001 Archive via Utility

Comando e controle

T1090.002 External Proxy T1095 Non-Application Layer Protocol T1104 Multi-Stage Channels T1105 Ingress Tool Transfer

Exfiltração

T1041 Exfiltration Over C2 Channel

Malwares e ferramentas

OSInfoMalwareS0165
PlugXMalwareS0013
RemoteCMDMalwareS0166
SHOTPUTMalwareS0063
LaZagneFerramentaS0349
schtasksFerramentaS0111