APT3
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT3Our name
- UPS TeamMandiant
- Gothic PandaPwC
- PirpiPwC
- TG-0110Recorded Future
- Threat Group-0110Recorded Future
- BuckeyeSymantec
Targets
Regions: United States, Hong Kong
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1005Data from Local System
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1021.002SMB/Windows Admin Shares
- T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.005Indicator Removal from Tools
- T1033System Owner/User Discovery
- T1036.010Masquerade Account Name
- T1041Exfiltration Over C2 Channel
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1056.001Keylogging
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1069Permission Groups Discovery
- T1070.004File Deletion
- T1074.001Local Data Staging
- T1078.002Domain Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1090.002External Proxy
- T1095Non-Application Layer Protocol
- T1098.007Additional Local or Domain Groups
- T1104Multi-Stage Channels
- T1105Ingress Tool Transfer
- T1110.002Password Cracking
- T1136.001Local Account
- T1203Exploitation for Client Execution
- T1204.001Malicious Link
- T1218.011Rundll32
- T1543.003Windows Service
- T1546.008Accessibility Features
- T1547.001Registry Run Keys / Startup Folder
- T1552.001Credentials In Files
- T1555.003Credentials from Web Browsers
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.