APT3

Overview

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.

Naming & attribution

APT3 is tracked under 7 names across the industry. It uses 44 documented ATT&CK techniques — more than 79% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT41 China — 31 shared techniques (33% overlap)
• GALLIUM China — 18 shared techniques (32% overlap)
• Patchwork — 19 shared techniques (29% overlap)
• APT39 Iran — 21 shared techniques (28% overlap)
• FIN13 — 21 shared techniques (28% overlap)
• Magic Hound Iran — 26 shared techniques (27% overlap)

Targets

Political party · Private sector

Regions

Hong Kong · United Kingdom · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 44 techniques across 11 tactics

Tools & malware (6)

OSInfo · schtasks · PlugX · LaZagne · SHOTPUT · RemoteCMD

Reporting (3)

• (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3 — Insikt Group (Recorded Future)
• Buckeye cyberespionage group shifts gaze from US to Hong Kong — Symantec Security Response
• A tale of Pirpi, Scanbox & CVE-2015-3113 — Lancaster, T