APT3 — Threat Actors — SecurityStudies.info

Profile

Also known as: BORON, Boyusec, Brocade Typhoon, BRONZE MAYFAIR, Buckeye, GOTHIC PANDA, Group 6, Pirpi, Red Sylvan, TG-0110, Threat Group-0110, UPS, UPS Team

Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets. However, Buckeyes focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.'

ATT&CK techniques · 44

Initial Access

T1078.002Domain Accounts T1566.002Spearphishing Link

Execution

T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1203Exploitation for Client Execution T1204.001Malicious Link T1574.001DLL

Persistence

T1098.007Additional Local or Domain Groups T1136.001Local Account T1543.003Windows Service T1546.008Accessibility Features T1547.001Registry Run Keys / Startup Folder

Stealth

T1027Obfuscated Files or Information T1027.002Software Packing T1027.005Indicator Removal from Tools T1036.010Masquerade Account Name T1070.004File Deletion T1218.011Rundll32 T1564.003Hidden Window

Credential Access

T1003.001LSASS Memory T1056.001Keylogging T1110.002Password Cracking T1552.001Credentials In Files T1555.003Credentials from Web Browsers

Discovery

T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery T1069Permission Groups Discovery T1082System Information Discovery T1083File and Directory Discovery T1087.001Local Account

Lateral Movement

T1021.001Remote Desktop Protocol T1021.002SMB/Windows Admin Shares

Collection

T1005Data from Local System T1074.001Local Data Staging T1560.001Archive via Utility

Command and Control

T1090.002External Proxy T1095Non-Application Layer Protocol T1104Multi-Stage Channels T1105Ingress Tool Transfer

Exfiltration

T1041Exfiltration Over C2 Channel

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential