APT3
APT3 is a China-nexus threat actor tracked under aliases including Pirpi, Buckeye, Gothic Panda, UPS Team, TG-0110/Threat Group-0110, Boron, Brocade Typhoon, Cybron, OldCarp, Red Sylvan, and UPS. The provided content associates APT3 with exploitation, persistence, execution, collection, and discovery activity. Reported behaviors include creating new Windows services for persistence; placing scripts in the Startup folder for persistence; using PowerShell, including -WindowStyle Hidden, to download and run payloads after exploitation; using cmd.exe /C whoami to verify SYSTEM-level privileges; executing commands on remote computers; establishing SOCKS5 connections for initial C2; listing running processes; obtaining local system information; identifying Microsoft Office documents; searching the local file system for files and directories; locating credentials in files on disk, including Firefox and Chrome-related files; gathering network configuration information such as MAC address, IP address, WINS, DHCP server, and gateway; staging files in a single location for exfiltration; and exfiltrating data over the C2 channel. The content also states that APT3 has used tools to dump passwords from browsers and that one tool dumped credentials by injecting into lsass.exe.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Associated vulnerabilities
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
APT3 has exploited... Internet Explorer vulnerability CVE-2014-1776.
APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113...
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Observables
41 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Uses credential dumping by injecting tooling into LSASS to extract credentials.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.