Loading story…
Researchers and independent investigators tied the Chinese cyber-espionage group APT3—also tracked as Gothic Panda, Buckeye, UPS Team, and TG-0110—to long-running intrusions targeting government, research, technology, aerospace, defense, transport, manufacturing, and telecommunications organizations. Reporting says the group used spear-phishing, browser and Flash zero-day exploits including CVE-2014-1776, CVE-2014-6332, and CVE-2015-3113, then deployed the Pirpi remote access trojan to move laterally, install backdoors, and steal intellectual property and other confidential data, initially focusing on the United States and United Kingdom before expanding activity to Hong Kong.
Technical analysis found APT3 repeatedly reused exploit components, shellcode, steganographic delivery through animated GIFs, and command-and-control patterns across campaigns, with Pirpi variants sharing encrypted HTTP cookie-based communications and similar command loops while newer builds added stronger obfuscation and anti-analysis features. Separate attribution research claimed historic DNS and WHOIS records linked infrastructure such as httb[.]net, vcersoft[.]com, uyre[.]net, inc-work[.]com, microsoft-ie[.]com, unixfocus[.]net, and shuyan[.]com to alleged operators including Wu Yingzhuo and Dong Hao, arguing that shared registration artifacts exposed personnel behind the espionage activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Intrusion Truth published an attribution chain linking Dong Hao to domains and registration artifacts associated with infrastructure previously tied to Wu Yingzhuo. The article concluded Dong Hao was a second alleged APT3 operator involved in registering domain names.
Intrusion Truth published research tracing historic WHOIS, DNS, and alias data from Pirpi-linked domains to an individual it identified as Wu Yingzhuo, alleging he was the 'Mr Wu' behind parts of APT3 infrastructure. The article also linked related domains and IP data to Guangdong, China, as further attribution context.
Intrusion Truth published a profile of APT3 describing its aliases, targeting, malware, and infrastructure tradecraft, and asserting that domain registration metadata could identify people and entities behind the group. The article also referenced a follow-up claim linking APT3 to Boyusec, described as a Chinese intelligence contractor.
Six months after Intrusion Truth's 2017 attribution reporting, U.S. authorities unsealed indictments against Wu Yingzhuo, Dong Hao, and Xia Lei on hacking-related charges. The indictment identified Trimble, Siemens, and Moody's Analytics as U.S. victims.
APT3 infections in Hong Kong increased significantly in March 2016, according to the reporting summarized in the reference. This indicated a notable escalation of the group's activity there.
Unit 42 reported that UPS exploited zero-days exposed in the Hacking Team breach. This connected the group to another set of high-end exploit operations in 2015.
FireEye published a blog post titled "Operation Clandestine Wolf" describing APT3 exploitation of an Adobe Flash zero-day. The reporting publicly documented the group's use of the vulnerability in active espionage operations.
Adobe patched CVE-2015-3113, a Flash zero-day that UPS had exploited in espionage activity. The vulnerability was part of a broader cluster of zero-day campaigns tied to the group.
Symantec reported that APT3 had begun infecting organizations in Hong Kong, marking an expansion beyond its earlier focus on the United States and United Kingdom. This represented a geographic shift in the group's victimology.
UPS exploited CVE-2014-6332 in a later 2014 campaign. FireEye reported the group used VBScript for this exploitation, and Unit 42 noted code and naming overlaps with other UPS zero-day activity.
APT3, tracked by Unit 42 as UPS, exploited CVE-2014-1776 in campaigns that delivered a Pirpi payload. Unit 42 later identified shared exploit and payload components linking this activity to later UPS operations.
FireEye first reported the cyber espionage group later tracked as APT3 in 2010. The group was associated with the Pirpi remote access trojan and targeting in the United States and United Kingdom.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
intrusiontruth.wordpress.com
Open sourceintrusiontruth.wordpress.com
Open sourceintrusiontruth.wordpress.com
Open sourceintrusiontruth.wordpress.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourcefireeye.com
Open sourcesymantec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports linked the Chinese espionage group **APT10**—also tracked as **MenuPass** and **Cicada**—to long-running intrusions that used **Poison Ivy**, **ChChes**, and **Sodamaster** against governments, NGOs, telecoms, legal, pharmaceutical, academic, media, and managed service provider targets across Asia, Europe, and North America. FireEye previously clustered Poison Ivy activity into the `menuPass`, `admin@338`, and `th3bug` campaigns, while Palo Alto documented `th3bug` watering-hole attacks that delivered Poison Ivy through compromised websites and infrastructure tied together by shared command-and-control patterns. Trend Micro also reported that the Japan-focused **ChessMaster** espionage campaign overlapped with APT10 in targeting, malware packaging, infrastructure, and tradecraft, and Symantec later said Cicada/APT10 expanded operations through prolonged intrusions, in some cases beginning with Microsoft Exchange access and persisting for months. Separate attribution research traced historical domain registrations, phishing metadata, social media accounts, and company records to alleged Tianjin-based operators including **Gao Qiang**, **Zhang Shilong**, and **An Zhiqiang**. Investigators said APT10-linked infrastructure such as `chromeenter[.]com`, `js001.3322[.]org`, `xiaohong[.]org`, and related domains connected to Tianjin email addresses, phone numbers, hostnames, and online personas including `fisherxp`, `baobeilong`, and `@gbaike`. The reporting argued that these overlaps tied real-world individuals and a Tianjin technology company to infrastructure associated with earlier **Cloud Hopper** and FireEye-tracked APT10 activity, strengthening claims that the group’s malware campaigns and domain operations were run by operators based in Tianjin, China.
Aug 15, 2026
A Chinese state-linked hacking group tracked as **APT10** was tied to a months-long supply-chain intrusion against Taiwan’s financial sector, compromising organizations through an undisclosed flaw in the web administration interface of a widely used securities software product. Researchers said the affected platform reportedly serves more than **80%** of Taiwan’s local financial organizations, giving the attackers broad downstream access. The campaign, tracked as **Operation Cache Panda**, was disguised in part as credential-stuffing activity while targeting brokerage data, personally identifiable information, and the ability to disrupt investment operations rather than steal funds directly. After initial access, the attackers uploaded the **ASPXCSharp** web shell to control exposed servers, used **Impacket** to scan internal networks, and moved laterally with **Remote Service** creation and **WMI**. They then deployed a **Quasar RAT** variant and other .NET payloads through reflective in-memory loading using tooling associated with **Donut** and **SharpSploit**, reducing on-disk artifacts and antivirus detection. Investigators also found the group established reverse-tunnel **RDP** access for persistent interactive control and used the Chinese cloud file-sharing service **WenShuShu** to retrieve tools during the operation.
Aug 15, 2026
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026