APT3

▲ High Threat China

Primary Aliases: Brocade Typhoon GOTHIC PANDA BORON Boyusec

Sponsor / State Affiliation China

Primary Motivation Espionage

Active Timeline Unknown – Present

Confidence Rating 70% (Grounded)

Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets. However, Buckeyes focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.'

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Private sector Political party

🛡️ MITRE ATT&CK® Attack Lifecycle (44 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spearphishing Link

Execution 4

T1059 Scheduled Task

T1059 Windows Command Shell

T1059 Exploitation for Client Execution

T1059 PowerShell

Persistence & Privilege Escalation 1

T1547 Registry Run Keys / Startup Folder

Defense Evasion 1

T1027 Indicator Removal from Tools

Credential Access & Discovery 11

T1003 Credentials from Web Browsers

T1003 System Network Configuration Discovery

T1003 System Network Connections Discovery

T1003 Credentials In Files

T1003 File and Directory Discovery

T1003 System Information Discovery

T1003 Process Discovery

T1003 Permission Groups Discovery

T1003 Remote System Discovery

T1003 Keylogging

T1003 System Owner/User Discovery

Lateral Movement & Collection 3

T1021 Local Data Staging

T1021 SMB/Windows Admin Shares

T1021 Remote Desktop Protocol

Command & Control 2

T1071 Exfiltration Over C2 Channel

T1071 Ingress Tool Transfer

Operational Techniques 20

T1000 Multi-Stage Channels

T1000 Password Cracking

T1000 Hidden Window

T1000 External Proxy

T1000 Obfuscated Files or Information

T1000 Additional Local or Domain Groups

T1000 Malicious Link

T1000 Domain Accounts

T1000 Data from Local System

T1000 Local Account

T1000 File Deletion

T1000 Accessibility Features

T1000 Archive via Utility

T1000 Windows Service

T1000 LSASS Memory

T1000 Non-Application Layer Protocol

T1000 Masquerade Account Name

T1000 Software Packing

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Anthropic Claude AI Agents Exploited by Generative Threat Groups GTGs for Automated Cyberattacks

Strategies and Tactics 2026-09-15

[DEEP DIVE] Coordinated Exploitation of Google Chrome and Microsoft Windows via BlueMoon Exploit Kit

Attacks and Vulnerabilities 2026-09-12

[DEEP DIVE] Google Chrome and Microsoft Windows Zero-Day Chain via BlueMoon Exploit Kit

Attacks and Vulnerabilities 2026-09-12

[DEEP DIVE] Iranian APT42 and APT35 Utilizing LLMs for AI-Augmented Spear-Phishing and Tamecat Malware Deployment

Attacks and Vulnerabilities 2026-08-15

[DEEP DIVE] Iranian APT Escalation: Massive Surge in Cyber Operations Against Israeli Infrastructure

Attacks and Vulnerabilities 2026-07-06

Copied to clipboard

LINK COPIED TO CLIPBOARD