Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT3 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT3

  • GOTHIC PANDA
  • TG-0110
  • Group 6
  • UPS
  • Buckeye
  • Boyusec
  • BORON
  • BRONZE MAYFAIR

state sponsor · ChinaMITRE G0022 ↗

APT3 — ATT&CK roseAP

attack rose · 44 techniques across 11 tactics

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2014-1776, CVE-2015-3113

Analyst brief

misp-galaxy + mitre-attack

Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets. However, Buckeyes focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.'

Observed targets (as stated by the sources)

3 countries · 2 sectors
United StatesUnited KingdomHong KongAssessed origin: China

assessed origin · Chinaobserved targets · 3

countries · 3

  • United States
  • United Kingdom
  • Hong Kong

sectors · 2

  • Private sector
  • Political party

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

44 techniques · 11 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    5 techniques

  3. Persistence

    4 techniques

  4. Privilege escalation

    1 technique

  5. Stealth

    9 techniques

  6. Credential access

    4 techniques

  7. Discovery

    9 techniques

  8. Lateral movement

    2 techniques

  9. Collection

    4 techniques

  10. Command and control

    4 techniques

  11. Exfiltration

    1 technique

select a technique

Arsenal

4 malware · 2 tools
Malware
Malware · 4ATT&CK
OSInfoS0165 ↗
PlugXS0013 ↗
SHOTPUTS0063 ↗
RemoteCMDS0166 ↗
Tools
Tools · 2ATT&CK
schtasksS0111 ↗
LaZagneS0349 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT3 is cited as exploiting

none on KEV
  1. CVE-2014-17762026-10-17
    1. “APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2015-31132026-10-17
    1. “APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016Buckeye cyberespionage group shifts gaze from US to Hong KongSymantec ↗

Take it with you

keyless · no signup

References

10 sources
  1. 1.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wol…
  2. 2.web.archive.org/web/20160910124439/http://www.symantec.com/connect/blo…
  3. 3.cfr.org/interactive/cyber-operations/apt-3
  4. 4.secureworks.com/research/threat-profiles/bronze-mayfair
  5. 5.mandiant.com/resources/insights/apt-groups
  6. 6.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/…
  7. 7.attack.mitre.org/groups/G0022
  8. 8.recordedfuture.com/research/chinese-mss-behind-apt3
  9. 9.pwc.blogs.com/cyber_security_updates/2015/07/pirpi-scanbox.html
  10. 10.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

Track APT3 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.