🇨🇳

APT3

APT Group Information theft and espionage 24 zero-day CVEs ETDA ✓

Also Known As 11 names

BORON BRONZE MAYFAIR Boyusec Brocade Typhoon Buckeye GOTHIC PANDA Group 6 Red Sylvan TG-0110 UPS APT 3

Target Countries 32

Countries highlighted in red

United Arab Emirates Belgium Brazil Canada Chile China Czech Republic Germany Egypt Finland France United Kingdom Hong Kong Israel India Iraq Islamic Republic of Iran Italy Kuwait Luxembourg Malaysia Nigeria New Zealand Philippines Russian Federation Sweden United States Uruguay Bolivarian Republic of Venezuela Vietnam South Africa Zambia

Sectors Targeted

Computer Systems Design and Related Services 54151 Motor Vehicle Manufacturing 3361 Advertising Agencies 54181 Personal Care Services 8121 All Other Information Services 51919 Construction Pharmaceutical and Medicine Manufacturing 32541 Defense Technology Transportation Newspaper Publishers 51111 Motion Picture and Video Production 51211 Justice, Public Order, and Safety Activities 9221 National Security and International Affairs 928110 Telecommunications Employment Placement Agencies and Executive Search Services 56131 Family Clothing Stores 44814 Commercial Banking 52211 Management Consulting Services 54161 Executive, Legislative, and Other General Government Support 9211 Elementary and Secondary Schools 6111 Grantmaking and Giving Services 8132 Public Administration 92 Civic and Social Organizations 8134 High-Tech Graphic Design Services 54143 Research and Development in the Social Sciences and Humanities 54172 Freight Transportation Arrangement 48851 Investigation, Guard, and Armored Car Services 56161 Data Processing, Hosting, and Related Services 51821 Internet Publishing and Broadcasting and Web Search Portals 51913 Computer Systems Design Services 541512 Other Amusement and Recreation Industries 7139 Oil and Gas Extraction 211 Offices of Lawyers 541110 Management, Scientific, and Technical Consulting Services 5416 Human Resources Consulting Services 541612 Finance and Insurance 52 Food Services and Drinking Places 722 Computer Systems Design and Related Services 5415 Utilities 22 National Security and International Affairs 9281 Manufacturing Aerospace

Details

Origin 🇨🇳 CN

Last Updated 27 May 2024

Malware Families 8

doublepulsar

sorgu

unidentified_075

keylogger_apt3

win.vipkeylogger

xserver

NewCore

darkstrat

MITRE ATT&CK 107

T1002 T1003 T1003.001 T1005 T1015 T1016 T1018 T1020 T1021 T1021.001 T1021.002 T1027 T1027.002 T1027.005 T1033 T1036 T1036.010 T1039 T1041 T1043 T1045 T1047 T1049 T1050 T1053 T1053.005 T1055.003 T1056 T1056.001 T1057 T1059 T1059.001 T1059.003 T1060 T1061 T1064 T1065 T1066 T1068 T1069 T1070 T1070.004 T1071 T1073 T1074 T1074.001 T1076 T1077 T1078 T1078.002 T1078.003 T1081 T1082 T1083 T1085 T1086 T1087 T1087.001 T1090 T1090.002 T1095 T1098 T1098.007 T1104 T1105 T1107 T1108 T1110 T1110.001 T1110.002 T1135 T1136 T1136.001 T1143 T1192 - Spearphishing Link T1199 T1203 T1204 T1204.001 - Malicious Link T1204.002 - Malicious File T1205.002 T1213 T1218 T1218.011 T1543 T1543.003 T1546 T1546.008 T1547 T1547.001 T1550.002 T1552 T1552.001 T1555 T1555.003 T1558 T1560 T1560.001 T1564 T1564.001 T1564.003 T1566 - Phishing T1566.002 T1570 T1574 T1574.001 T1574.002

Related Zero-Days 24

CVE-2016-4171 CVE-2017-0144 CVE-2018-4878 CVE-2019-19781 CVE-2021-26829 CVE-2021-26855 CVE-2022-1040 CVE-2023-0669 CVE-2023-20198 CVE-2023-23397 CVE-2023-27350 CVE-2023-38831 CVE-2023-46805 CVE-2024-12356 CVE-2024-21887 CVE-2024-24919 CVE-2024-3400 CVE-2024-38178 CVE-2024-47575 CVE-2024-4947 CVE-2025-49704 CVE-2025-53770 CVE-2025-53771 CVE-2025-9491

Known Names 11 entries

APT 3 Mandiant

Gothic Panda CrowdStrike

Buckeye Symantec

TG-0110 SecureWorks

Bronze Mayfair SecureWorks

UPS Team Symantec

Group 6 Talos

Red Sylvan PWC

Boron Microsoft

Brocade Typhoon Microsoft

G0022 MITRE

Observed Target Countries 9

Based on ETDA data — countries highlighted in red

Belgium Hong Kong Italy Luxembourg Philippines Sweden UK USA Vietnam

Description

(Recorded Future) APT3 (also known as UPS, Gothic Panda, and TG-0110) is a sophisticated threat group that has been active since at least 2010. APT3 utilizes a broad range of tools and techniques including spear-phishing attacks, zero-day exploits, and numerous unique and publicly available remote access tools (RAT). Victims of APT3 intrusions include companies in the defense, telecommunications, transportation, and advanced technology sectors — as well as government departments and bureaus in Hong Kong, the U.S., and several other countries.

Tools Used 15

APT3 Keylogger Bemstour DoublePulsar EternalBlue HTran Hupigon LaZagne OSInfo Pirpi PlugX RemoteCMD shareip TTCalc w32times several 0-days for IE, Firefox and Flash

Operations 7

2007 Hupigon and Pirpi Backdoors https://www.fireeye.com/blog/threat-research/2010/11/ie-0-day-hupigon-joins-the-party.html

2014-04 Operation “Clandestine Fox” FireEye Research Labs identified a new Internet Explorer (IE) zero-day exploit used in targeted attacks. The vulnerability affects IE6 through IE11, but the attack is targeting IE9 through IE11. This zero-day bypasses both ASLR and DEP. Microsoft has assigned CVE-2014-1776 to the vulnerability and released security advisory to track this issue. https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html

2014-06 Operation “Clandestine Fox”, Part Deux While Microsoft quickly released a patch to help close the door on future compromises, we have now observed the threat actors behind “Operation Clandestine Fox” shifting their point of attack and using a new vector to target their victims: social networking. https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html

2014-11 Operation “Double Tap” This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations. The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113. https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

2015-06 Operation “Clandestine Wolf” In the last several weeks, APT3 actors launched a large-scale phishing campaign against organizations in the following industries: Aerospace and Defense, Construction and Engineering, High Tech, Telecommunications and Transportation. https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html

2016-03 Variant of the DoublePulsar Backdoor Beginning in March 2016, Buckeye began using a variant of DoublePulsar (Backdoor.Doublepulsar), a backdoor that was subsequently released by the Shadow Brokers in 2017. DoublePulsar was delivered to victims using a custom exploit tool (Trojan.Bemstour) that was specifically designed to install DoublePulsar. https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit https://research.checkpoint.com/upsynergy/

2016-03 Buckeye cyberespionage group shifts gaze from US to Hong Kong https://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong

Reports & References 2

https://intrusiontruth.wordpress.com/2017/05/09/apt3-is-boyusec-a-chinese-intelligence-contractor/ https://www.recordedfuture.com/chinese-mss-behind-apt3/

ETDA Profile

APT 3, Gothic Panda, Buckeye

Origin

China

First Seen 2007

Sponsor State-sponsored, Ministry of State Security and Internet security firm Guangzhou Bo Yu Information Technology Company Limited (“Boyusec”)

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0022/

View on ETDA APT Groups ↗