APT3, also called Gothic Panda, is a China-aligned cyber espionage group. As recorded by MITRE ATT&CK, researchers attribute it to China’s Ministry of State Security. This post covers:
- How APT3 gained access.
- The tools it used.
- The sectors it targeted.
- Its main operations by year.
- What defenders can still learn from it.
Introduction
The APT3 cyber threat group is one of the earliest of today’s Advanced Persistent Threat groups. It was instrumental in shaping the tactics, techniques and operational model of many China-aligned cyber threat groups. For more than a decade APT3 has continued to evolve as an organization, albeit with varied levels of activity over time. APT3 provides a baseline for evaluating the relationship between state intelligence needs and private sector capabilities.
It also serves as an example of what to expect from similar groups in the future. Many other names refer to APT3. They include BRONZE MAYFAIR, GOTHIC PANDA, BORON, Boyusec, Brocade Typhoon, Buckeye, TG-0110 and UPS. These multiple terms are the result of different cybersecurity vendors and intelligence agencies conducting research on common activity clusters of APT3.
Who is APT3 and who is it attributed to?
APT3 (Aptitude Threat Infiltration Group 3), formerly known as Boyusec, is considered part of the Chinese Cyber Espionage Program (CCEP). The CCEP has been established since around 2010-11 by China’s State Council and Ministry of State Security, and the two have an ongoing association. The relationship between APT3 and Boyusec gives a unique view of how such groups collaborate with private companies on cyber operations.
APT3 is also the only known APT group to have been established in partnership with a commercial cybersecurity organization (Boyusec). Both public and corporate intelligence demonstrate that APT3 supports several long-term APT3 objectives. MITRE ATT&CK does not list Boyusec among the names for APT3.
It records that researchers have attributed APT3 to China’s Ministry of State Security (MITRE ATT&CK G0022).
What does APT3 want?
The main purpose for APT3 has always been to obtain sensitive information through cyber espionage, as opposed to generating revenue through online services. APT3 focuses primarily on obtaining Defensive Technology, Advanced Manufacturing and Critical Infrastructure information, giving them sustained access to high-value networks. Most companies APT3 targeted provided or facilitated innovation and policy development. Through these companies, APT3 is able to collect valuable economic and strategic information.
Tactics, Techniques, and Procedures (TTPs)
APT3 use sophisticated tactics that advanced for their time, used more innovative than other actors did at that time.
Initial Access
APT3 had a variety of methods used for gaining access, using social engineering techniques through email and exploiting weaknesses in public-facing servers. They could weaponize new vulnerabilities very quickly after disclosure. In some cases this happened before a vendor had released a patch for the weakness.
In several of their campaigns, they took advantage of watering hole attacks. They compromised the website of an organization with which they were associated and then used those sites to distribute malware selectively to their targets.
Exploitation and Execution
APT3 is known for developing and using custom exploit frameworks. APT3 developed and maintained the exploit framework. It gave them the capability to exploit different versions of commonly used enterprise software. Using these exploitation frameworks, a user could execute payloads, escalate privileges, bypass security controls, and operate reliably.
APT3’s malware loader was modular. It let an operator run specific payloads based on the victim environment and the intelligence requirements.
Persistence and Lateral Movement
After gaining access to a network, APT3 used other ways to regain access repeatedly. These included creating scheduled tasks, installing services and modifying registry entries. APT3 was adept at exploiting the inner workings of Windows.
It had strong knowledge of enterprise networking environments and how they operate. This let it move easily from one workstation or system within a network to another.
Stealing credentials, utilizing pass-the-hash techniques, and using administrative tools to escalate privileges, were widely used. All of these methods allowed an APT3 operator to gain wider access with minimal effort through less visible and detectable means.
Command and Control
APT3 made extensive use of flexible C2 structures. They combined standard and malicious web traffic over the common HTTP/HTTPS protocols. Domains were created to look like legitimate domains. The entire infrastructure changed continuously to minimize the chance of detection or identification.
Early in their operations, APT3 conducted numerous trials using proxy networks and multi-hop C2 communication chains. All of this increased the complexity of defensive operations.
- Gain accessSocial engineering by email or exploiting public-facing serversTechnique T1566.002 (MITRE ATT&CK, opens in a new tab)
- Exploit and executeCustom exploit framework and a modular malware loader
- PersistScheduled tasks, installed services and registry changesTechnique T1053.005 (MITRE ATT&CK, opens in a new tab)
- Move laterallyStolen credentials, pass-the-hash and administrative tools
- Command and controlFlexible HTTP and HTTPS traffic with changing look-alike domains
Malware and Tooling
APT3 has a record of multiple types of well-known malware and tool sets that have had an impact on the subsequent China-linked attacks. These tools included custom built backdoors, exploit kits and utilities for stealing user credentials.
APT3 toolsets have been noted for their ‘industrial strength’ design. They were built for use in larger enterprise environments (‘multiple environments’). This meant APT3 focused on larger, complex entities (such as defense contractors and industrial companies).
The sophistication of APT3’s tool environment placed it among the most capable APT actors of its day. This was especially true during its peak years, 2012 to 2016.
Who does APT3 target?
APT3’s target set is extensive yet consistent with their broader strategy.
Primary Targets
- U.S. and Euro defense contractors, U.S. and Euro military researchers
- Firms that develop and manufacture aerospace components and advanced manufacturing equipment
- Telecoms and tech firms that manufacture infrastructure
- Government and policy agencies
Geographic Focus
APT3 operated on multiple continents, including: U.S., Eur, and E. Asia
The group’s targeting patterns indicate a significant focus on gathering technology and intelligence with long-term benefits.
What operations is APT3 known for?
APT3’s historical cyber espionage campaigns have been quite extensive and covered:
- 2012–2014: Consisting of the initial campaigns that focused on defense contractors in the U.S. and Europe and included custom exploit toolkits and backdoors.
- 2015–2016: Which represented the peak of their activity with rapid exploitation of enterprise vulnerabilities leading to significant IP theft.
- 2017: Where public disclosure and indictments caused a disruption in their activity and showed a downward trend thereafter.
- Post-2018: Reduced visibility but suspected continued low-level or restructured activity within broader China-nexus ecosystems.
These operations underscore APT3’s historical importance rather than current volume.
Is APT3 still active?
Over time, the operational model adopted by APT3 has changed, mostly due to public attribution and subsequent legal action. Most importantly, fewer analysts link APT3’s current operations to previous operations. This may suggest that APT3 personnel, tools or methods were absorbed into other groups within the wider China cyber threat environment.
The legacy of APT3 continues today, particularly within newer cyber espionage actors. APT3’s methods are seen as influencing exploit development and the growth of enterprise-level intrusion operations.
Threat Assessment
Today, APT3 has been identified as a historically high-threat, yet still relatively low-risk operator. APT3 is a low-risk threat actor, and many of its earlier campaigns are no longer actively operated. However, many organizations will have some historical exposure to APT3’s intrusion activity. They may therefore still face some risk from previously compromised systems or stolen intellectual property.
APT3’s activities show that early investment in developing exploit technologies can yield long-term operational advantages for an operator. So can the discipline used to maintain the integrity of the exploit.
How can defenders handle APT3?
When defending against threats like APT3, defenders can incorporate several pieces of information from APT3’s defensive strategies:
- The quickest way to avoid intrusion is through hastily made patches to enterprise systems, including software, applications, and services
- Identifying abuse of legitimate processes and practices is critical
- Often, when an operator has kept up an extended period of inactivity, it has used stealth as the weapon of choice rather than overt exploitation.
Understanding how APT3 operated is important for protection against the current threats from actors aligned with Chinese interests in espionage.
Conclusion
Cyber espionage history has APT3 as a unique entity. Several new standards created through APT3’s work serve as a blueprint for state and private sector partnership. Many of the ideas used by advanced threat actors today were developed by APT3.
Currently, APT3 does not exist in the capacity that it once did. However, many companies and agencies are developing their techniques based on APT3’s extensive work, which continues to impact the nature of modern cyber threateners. Cybersecurity defenders can learn about today’s high-end constant threats through examining APT3’s contributions to developing the techniques constituting today’s high-end constant threats.
You can download and review the sheet for all the details!
