AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0022 · 44 ATT&CK techniques · 0 correlated reports

APT3

Aliases: Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

Open interactive actor investigation

ATT&CK techniques

T1053.005
Scheduled Task T1104
Multi-Stage Channels T1110.002
Password Cracking T1564.003
Hidden Window T1555.003
Credentials from Web Browsers T1059.003
Windows Command Shell T1016
System Network Configuration Discovery T1049
System Network Connections Discovery T1090.002
External Proxy T1218.011
Rundll32 T1027
Obfuscated Files or Information T1566.002
Spearphishing Link T1098.007
Additional Local or Domain Groups T1204.001
Malicious Link T1041
Exfiltration Over C2 Channel T1552.001
Credentials In Files T1074.001
Local Data Staging T1078.002
Domain Accounts T1005
Data from Local System T1203
Exploitation for Client Execution T1021.002
SMB/Windows Admin Shares T1574.002
DLL Side-Loading T1087.001
Local Account T1070.004
File Deletion T1083
File and Directory Discovery T1546.008
Accessibility Features T1560.001
Archive via Utility T1082
System Information Discovery T1059.001
PowerShell T1543.003
Windows Service T1003.001
LSASS Memory T1547.001
Registry Run Keys / Startup Folder T1021.001
Remote Desktop Protocol T1057
Process Discovery T1095
Non-Application Layer Protocol T1069
Permission Groups Discovery T1018
Remote System Discovery T1056.001
Keylogging T1036.010
Masquerade Account Name T1027.002
Software Packing T1136.001
Local Account T1105
Ingress Tool Transfer T1033
System Owner/User Discovery T1027.005
Indicator Removal from Tools

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research