{
  "id": "apt3",
  "name": "APT3",
  "aliases": [
    "Gothic Panda",
    "Pirpi",
    "UPS Team",
    "Buckeye",
    "Threat Group-0110",
    "TG-0110"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.",
  "specs": [
    {
      "k": "sponsor",
      "v": "China's Ministry of State Security (MSS)",
      "src": [
        "mitre-g0022"
      ],
      "conf": "high"
    },
    {
      "k": "attack_id",
      "v": "G0022",
      "src": [
        "mitre-g0022"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.",
      "src": [
        "mitre-g0022"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 44,
      "src": [
        "mitre-g0022"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "LaZagne, OSInfo, PlugX, RemoteCMD, schtasks, SHOTPUT",
      "src": [
        "mitre-g0022"
      ],
      "conf": "high",
      "note": "6 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0022)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/apt3.html",
  "sources": {
    "mitre-g0022": {
      "title": "APT3, Group G0022",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0022/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}