- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Ministry of State Security and Internet security firm Guangzhou Bo Yu Information Technology Company Limited (“Boyusec”)
- Agency named
- Ministry of State Security
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2007–2026
- Status
- Active
- ATT&CK
- G0022 · 44 techniques
- Sources
- 13 sources carry it
- Identifier
- GINC-APT-0010 · apt3
ChinaWhat it is
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Gothic Panda
- Mandiant
- APT 3
- Microsoft
- Brocade Typhoon
- MITRE ATT&CK
- G0022
- PwC
- Red Sylvan
- Secureworks
- TG-0110, Threat Group-0110
- Talos and others
- Group 6, Group6
- Operations
- Operation “Clandestine Fox”, Operation “Clandestine Fox”, Part Deux, Operation “Clandestine Wolf”, Operation “Double Tap”
- Other names
- APT 3, Gothic Panda, Buckeye, Boron, Boyusec, Boyusec – the Guangzhou Boyu Information Technology Company, Bronze Mayfair, Buckeye, CYBRAN, Ltd, OLDCARP, Part Deux, Pirpi, UPS, UPS Team
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Belgium, Hong Kong, Italy, Luxembourg, Philippines, Sweden, United Kingdom, United States, Vietnam
- Sectors
- Aerospace, Construction, Defense, High-Tech, Manufacturing, Political party, Private sector, Technology, Telecommunications, Transportation
Tools
The tools and malware families the sources tie to it.
- APT3 Keylogger
- Bemstour
- Cookie Cutter
- Cyber Eye RAT
- CyberGate
- DoublePulsar
- EternalBlue
- Filensfer
- Firefox
- Firefox and Flash
- HTran
- Hupigon
- Kaba
- LaZagne
- OSInfo
- Pirpi
- PlugX
- PlugX/Sogu
- RemoteCMD
- SHOTPUT
- Shadow Brokers exploits
- Shotput
- SportLoader
- TTCalc
- and Flash
- many 0days: IE
- schtasks
- several 0-days for IE
- shareip
- w32times
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de