APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.12 This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.34 As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.5
- FireEye Clandestine Wolf
- Recorded Future APT3 May 2017
- FireEye Clandestine Wolf
- FireEye Operation Double Tap
- Symantec Buckeye
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | APT3 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Gothic Panda | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Pirpi | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | UPS Team | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Buckeye | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Threat Group-0110 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TG-0110 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1104 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1033 | System Owner/User Discovery | — |
| T1036.010 | Masquerade Account Name | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1069 | Permission Groups Discovery | — |
| T1070.004 | File Deletion | — |
| T1074.001 | Local Data Staging | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1090.002 | External Proxy | — |
| T1095 | Non-Application Layer Protocol | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1104 | Multi-Stage Channels | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.002 | Password Cracking | — |
| T1136.001 | Local Account | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1218.011 | Rundll32 | — |
| T1543.003 | Windows Service | — |
| T1546.008 | Accessibility Features | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.001 | Credentials In Files | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1564.003 | Hidden Window | — |
| T1566.002 | Spearphishing Link | — |
| T1574.001 | DLL | — |
Aliases
APT3 · Buckeye · Gothic Panda · Pirpi · TG-0110 · Threat Group-0110 · UPS Team
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.