← Back to Actors
APT3
APT3Gothic PandaPirpiUPS TeamBuckeyeThreat Group-0110TG-0110
[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.(Citation: Symantec Buckeye)
44
Techniques
42
Covered
2
Gaps
95%
Coverage
Coverage42/44
COVERED (42)
T1003.001LSASS Memory111 det.T1005Data from Local System51 det.T1016System Network Configuration Discovery41 det.T1018Remote System Discovery52 det.T1021.001Remote Desktop Protocol55 det.T1021.002SMB/Windows Admin Shares74 det.T1027Obfuscated Files or Information707 det.T1027.002Software Packing2 det.T1027.005Indicator Removal from Tools6 det.T1033System Owner/User Discovery62 det.T1041Exfiltration Over C2 Channel32 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1056.001Keylogging4 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1069Permission Groups Discovery40 det.T1070.004File Deletion46 det.T1074.001Local Data Staging10 det.T1078.002Domain Accounts28 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1087.001Local Account35 det.T1090.002External Proxy9 det.T1095Non-Application Layer Protocol26 det.T1098.007Additional Local or Domain Groups10 det.T1105Ingress Tool Transfer199 det.T1110.002Password Cracking2 det.T1136.001Local Account46 det.T1203Exploitation for Client Execution81 det.T1204.001Malicious Link11 det.T1218.011Rundll3278 det.T1543.003Windows Service80 det.T1546.008Accessibility Features8 det.T1547.001Registry Run Keys / Startup Folder53 det.T1552.001Credentials In Files62 det.T1555.003Credentials from Web Browsers16 det.T1560.001Archive via Utility27 det.T1564.003Hidden Window11 det.T1566.002Spearphishing Link1194 det.T1574.001DLL111 det.