aol.pm

APT3

IntrusionSet · ATTACK:enterprise:G0022

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0022",
  "title": "APT3",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0022",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--0bbdf25b-30ff-4894-a1cd-49260d0dd2d9",
  "external_id": "G0022",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:55.853Z",
  "modified": "2026-07-31T18:47:36.902Z",
  "version": "1.4",
  "aliases": [
    "APT3",
    "Gothic Panda",
    "Pirpi",
    "UPS Team",
    "Buckeye",
    "Threat Group-0110",
    "TG-0110"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "APT3"
    },
    {
      "source_name": "UPS Team"
    },
    {
      "source_name": "Pirpi"
    },
    {
      "source_name": "Gothic Panda"
    },
    {
      "source_name": "Threat Group-0110"
    },
    {
      "source_name": "TG-0110"
    },
    {
      "source_name": "Buckeye"
    },
    {
      "source_name": "FireEye Clandestine Wolf",
      "url": "https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"
    },
    {
      "source_name": "Recorded Future APT3 May 2017",
      "url": "https://www.recordedfuture.com/research/chinese-mss-behind-apt3"
    },
    {
      "source_name": "PWC Pirpi Scanbox",
      "url": "http://pwc.blogs.com/cyber_security_updates/2015/07/pirpi-scanbox.html"
    },
    {
      "source_name": "FireEye Operation Double Tap",
      "url": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
    },
    {
      "source_name": "Symantec Buckeye",
      "url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
    }
  ]
}

Explicit source assertions (50)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ca1948b-476c-4ff5-a792-f3790250bdc1

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1104

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1258536b-6cf4-4cfe-98c7-e9c1d30c5a34

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1110.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1334cbe3-8613-4279-9a1f-58781c2656a4

APT3 Adversary Emulation Plan

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0165

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16ef3e00-dc40-462c-9b74-5e8a8b24c86e

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c1296da-4504-4f00-b16a-8ecc29820ea9

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c812537-dfaf-40da-a71b-a49c18870b77

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3427863f-d4c4-4272-ad60-1479e42ed4af

FireEye Clandestine Fox Part 2

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3911c758-2c61-4615-88a1-4b9f21c99a9c

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41d61146-4a42-4897-b4a1-a706130a322d

FireEye Operation Double Tap · Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48042284-2fde-43f0-a3dc-f64e9f16bd77

Symantec Buckeye · evolution of pirpi

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d82bac6-ec9d-4f4b-a471-169728a830a4

FireEye Clandestine Fox · Symantec Buckeye · evolution of pirpi

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f76fd4d-a638-41a0-90b9-bd4ada6f93f3

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--555e47f2-54bb-4c97-8804-536aa354126c

FireEye Clandestine Fox

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56c927c5-f64e-4b31-9a14-7ce78fd1c8a1

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--598e9cc3-818c-4fc0-baf3-aba229543da5

FireEye Clandestine Wolf

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0349

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b50193e-6a97-432a-8839-6bb18e88271f

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1098.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62f16083-efca-477c-8107-e208ca4c75cb

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67e3c192-f0f3-4b8d-9fd7-b4200acebd85

FireEye Clandestine Wolf

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68edf451-bda3-4159-9715-dbcfda8eb8e2

FireEye Clandestine Fox

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80dcd852-39c2-4ef9-a401-e54982010a65

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87ddc052-0933-4722-9fb2-4653c4a3663c

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ac07a3f-9468-47a3-8ecc-c432f80e03f4

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f6701a2-91cc-449e-98e1-e83bd2f7317c

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--924c8549-a033-44f9-8823-64e95fe339e7

FireEye Clandestine Wolf · FireEye Clandestine Fox

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96797ece-5783-4d34-a399-32496c8705ac

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99c0cda4-91b1-4845-9891-9a4b89c128f9

FireEye Clandestine Fox · FireEye Clandestine Fox Part 2

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a615c7f-986d-4769-bea6-af9ffe0d575e

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b7bf5d9-23a0-4190-80c0-b27b906bafcc

FireEye Clandestine Fox

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8b248fe-a27c-40fd-83d5-f4382035d656

FireEye Clandestine Fox · evolution of pirpi

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a92197a8-ec5c-4366-92af-f45078a3bfd7

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b028b9a6-4031-4b56-8dd5-0bdd3c59dbec

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0791504-fc65-402b-bc47-bd96ed4abea1

Symantec Buckeye · evolution of pirpi

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba1b953d-08ce-4b4b-924e-92556cdf1d90

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc9cfe76-2d64-4901-8e9e-c69d046cdfaa

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c948f964-e26c-4226-9577-7b78b5bf271f

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc705bf0-ba29-443e-9cd5-aef247505210

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2858dfa-504f-416d-8801-41a1a9561f22

Twitter Cglyer Status Update APT3 eml · aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0063

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d924c061-9ee2-45c2-9ea4-491a2d3f50a5

FireEye Clandestine Wolf

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--daf56e8e-ea82-4ef2-bb03-78dd7e6ef3c0

FireEye Clandestine Fox · evolution of pirpi

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df4b49f1-71ca-4744-8554-47bf36174d89

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1069

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e590aaaa-40fd-4f61-93f3-f2d6daee65a4

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7714693-e792-44f0-a224-9899df75fced

FireEye Clandestine Fox · Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed283e07-a029-4d23-aa8f-55f92abb5203

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1036.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed46ee23-87eb-40e0-99ae-b396440f66bf

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef1cdbe7-29c9-4be9-a3f7-96e5b7bae031

APT3 Adversary Emulation Plan · FireEye Clandestine Wolf

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0b3c919-bf39-4bc9-9488-5f30d5407c54

aptsim

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0166

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f24d37c0-283d-4f37-8278-07fc75cc0e94

Symantec Buckeye

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f661bda3-d524-44b3-aeb0-d8dd8879a569

FireEye Clandestine Fox

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcfb3ce0-01a0-4f92-8e18-b323202d095d

FireEye Operation Double Tap

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--febbf503-d7e5-4896-90b9-35b6a811b19b

APT3 Adversary Emulation Plan

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.