APT3 is a China based threat group that MITRE ATT&CK attributes to China's Ministry of State Security and tracks under the identifier G0022. Vendor reporting also calls it Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110 and TG-0110. It is credited with three named campaigns, three of its alleged members were indicted in the United States in 2017, and it is the group tied to the strangest unresolved story in recent espionage research: it was using Equation Group tooling roughly a year before that tooling leaked publicly. This page collects what is documented about APT3 in public sources, with dates and CVE numbers attached so every claim can be checked.
Attribution and the 2017 Indictment
The strongest public evidence tying APT3 to a real organisation is a United States federal indictment. Three Chinese nationals, Wu Yingzhuo, Dong Hao and Xia Lei, were indicted on 13 September 2017, and the Department of Justice announced the case publicly in November 2017. All three were connected to Guangzhou Bo Yu Information Technology Company Limited, a firm that presented itself as an internet security company and is usually shortened to Boyusec. Wu Yingzhuo was a founding member and equity shareholder. Dong Hao held the title of executive director and manager. Xia Lei was an employee during part of the period covered by the charges.
The charges covered intrusions between 2011 and May 2017 against three corporate victims: Moody's Analytics, Siemens AG and Trimble Inc. The indictment describes at least 400 gigabytes of stolen data along with confidential email. The counts included conspiracy to commit computer fraud and abuse, conspiracy to commit trade secret theft, wire fraud and aggravated identity theft.
That is the part of the APT3 record resting on a sworn legal document rather than on inference from malware samples. Everything below comes from vendor telemetry and should be read as vendor attribution, which is a different standard of evidence.
Targeting Shifted in 2015
MITRE records that until mid 2015 APT3 focused mainly on victims in the United States, then moved toward political organisations in Hong Kong. Symantec's later work on the same group, which it calls Buckeye, lists targets in Hong Kong, Belgium, Luxembourg, the Philippines, Vietnam, Sweden, Italy, the United Kingdom and the United States. The geography is worth noting because it is broader than the espionage-against-US-industry framing that the indictment alone would suggest.
The Three Campaigns and the Zero-Days
APT3 built its reputation on burning genuine zero-days rather than recycling public exploits. The record shows it did both.
Operation Clandestine Fox, 2014
This campaign used CVE-2014-1776, a use after free flaw in Internet Explorer. MITRE lists it under Exploitation for Client Execution (T1203) as one of only two client side vulnerabilities the group is documented to have exploited.
Operation Double Tap, November 2014
Reported by FireEye as beginning on 19 November 2014, this campaign is the counterexample to the zero-day reputation. It paired CVE-2014-6332, a Windows OLE Automation Array remote code execution flaw disclosed publicly on 11 November 2014, with CVE-2014-4113, a privilege escalation flaw disclosed on 14 October 2014. Both were already public when the campaign ran. CVE-2014-6332 drew particular attention because the affected code path had been remotely exploitable across Windows releases going back to Windows 95.
Operation Clandestine Wolf, 2015
This campaign used CVE-2015-3113, an Adobe Flash Player zero-day. MITRE lists it alongside CVE-2014-1776 under T1203.
Bemstour: Equation Group Tools Before the Leak
The most consequential piece of APT3 research is Symantec's 2019 finding that the group was using Equation Group tooling about a year before the Shadow Brokers published it.
From March 2016 the group deployed a variant of DoublePulsar, a backdoor the Shadow Brokers only released in 2017. It was delivered by a custom exploit tool Symantec named Bemstour, built specifically to install DoublePulsar. Bemstour chained two Windows vulnerabilities to reach remote kernel code execution. The first was CVE-2019-0703, a zero-day Symantec discovered, reported to Microsoft in September 2018 and saw patched on 12 March 2019. The second was CVE-2017-0143, which Microsoft patched in March 2017 after it surfaced in the EternalRomance and EternalSynergy exploit tools.
How the group obtained those tools a year ahead of the public leak has never been established. Symantec said so plainly and nobody has closed the question since.
There is a second unresolved thread, and it matters for anyone citing APT3 as a live threat. Symantec reported that activity involving known Buckeye tools stopped in mid 2017, which lines up with the indictment, yet Bemstour and the DoublePulsar variant kept appearing until at least September 2018. The newest Bemstour sample Symantec saw was compiled on 23 March 2019, eleven days after Microsoft patched the zero-day it depended on. Symantec offered two possibilities without choosing between them: the group retooled after being exposed, or it passed tools to an associated group. Either way, the publicly documented operational trail for APT3 itself ends in 2017.
What Our Own Tracking Recorded
Our collection pipeline counted 83,223 activity items matching APT3 selectors as of 11 August 2026, and no posts on actor operated Telegram channels or breach forums in the seven days before that date. Those are counts from our own tooling and we publish them as exactly that. They are not corroborated by any public reporting, and as the section above sets out, the publicly documented operational record for this group ends in 2017. Read the counter as an internal collection signal, not as evidence that APT3 is running campaigns today.
Tools and Techniques on Record
MITRE ATT&CK associates six pieces of software with G0022: LaZagne, OSInfo, PlugX, RemoteCMD, schtasks and SHOTPUT. As of version 1.4 of the group page, last modified on 31 July 2026, it maps 44 techniques to APT3. The subset below is the one worth handing to a detection engineer, because each entry describes a concrete observable rather than a category.
| ID | Technique | Documented behaviour |
|---|---|---|
| T1566.002 | Phishing: Spearphishing Link | Spearphishing email carrying malicious links, paired with T1204.001 for the click |
| T1203 | Exploitation for Client Execution | CVE-2014-1776 in Internet Explorer and CVE-2015-3113 in Adobe Flash Player |
| T1059.003 | Windows Command Shell | A downloader runs cmd.exe /C whoami to confirm it holds System privileges |
| T1053.005 | Scheduled Task | Persistence via schtasks /create /tn mysc /tr C:\Users\Public\test.exe /sc ONLOGON /ru System |
| T1546.008 | Accessibility Features | Replaces the Sticky Keys binary at C:\Windows\System32\sethc.exe |
| T1136.001 | Create Account: Local Account | Creates or enables accounts such as support_388945a0, also mapped to T1036.010 |
| T1098.007 | Additional Local or Domain Groups | Adds the accounts it created to local administrator groups |
| T1003.001 | OS Credential Dumping: LSASS Memory | Injects into lsass.exe, triggered with the argument dig |
| T1110.002 | Brute Force: Password Cracking | Cracks recovered hashes to obtain usable plaintext credentials |
| T1021.001 | Remote Services: RDP | Enables RDP for persistence, then browses and copies files over the session |
| T1104 | Multi-Stage Channels | A downloader opens SOCKS5 to 192.157.198[.]103 on TCP 1913, then requests 192.184.60[.]229 on TCP 81 |
| T1574.001 | Hijack Execution Flow: DLL | Side loads a DLL using a legitimate signed copy of Chrome |
Where to Start If You Are Building Detections
The ATT&CK map is long, but the group's documented tradecraft clusters into a few places that are cheap to watch and expensive for an intruder to avoid.
- Alert on Sticky Keys tampering. Any write to
C:\Windows\System32\sethc.exe, or a debugger registry entry pointing at it, is worth waking someone up for. Legitimate software does not do this. - Watch local account creation followed by group membership change. The pairing of T1136.001 and T1098.007 within a short window is the signal. The literal string
support_388945a0is a free high confidence detection, since it is documented in the group's own tooling. - Treat
schtasks /createwith/ru Systemand an ONLOGON trigger as suspicious by default, particularly when the target binary sits underC:\Users\Public. - Monitor LSASS handle access. Credential dumping is the hinge in this group's chain: everything after it, the brute forcing, the RDP movement, the admin share copies, depends on it succeeding.
- Log outbound SOCKS5 on non-standard ports. The documented downloader used TCP 1913 and TCP 81, which is exactly the kind of traffic that passes unexamined in most environments.
The two campaign patterns also carry a general lesson. Clandestine Fox and Clandestine Wolf were zero-days, and nothing but fast patching and exploit mitigation helps against those. Operation Double Tap was not: it ran on flaws that had been public for eight days and five weeks respectively. That second pattern is the one most organisations actually lose to, and it is the one patch cadence solves.
Related Reading
- APT28 PRISMEX Malware: Zero-Day Exploit Analysis, a comparable state linked group with an active tooling trail.
- CVE-2026-21513 MSHTML Zero-Day Exploit Tied to APT28, on browser engine exploitation of the kind APT3 used against Internet Explorer.
- Threat Intel Briefing: Zero-Day, Ransomware and Data Leaks.
- All threat intelligence coverage.
Sources for this page: MITRE ATT&CK group G0022 version 1.4, last modified 31 July 2026; the United States Department of Justice announcement of the Boyusec indictment, September and November 2017; Symantec's Buckeye research published May 2019; and FireEye's Operation Double Tap reporting, November 2014.
Analysis produced by the Purple-Ops threat intelligence team from public source review and our own vulnerability triage and threat-intelligence tracking.
