State-backedChina MITRE G0022

APT3

Also known as GOTHIC PANDA, TG-0110, Group 6, UPS, Buckeye, Boyusec, BORON, BRONZE MAYFAIR, Red Sylvan, Brocade Typhoon, Pirpi, UPS Team, Threat Group-0110

1mentions, 7 days

1mentions, 30 days

Nov 5, 2026last mentioned

Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets. However, Buckeyes focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.'

Targets: Private sector, United States, United Kingdom, Hong Kong

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1005 Data from Local System T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1027 Obfuscated Files or Information T1027.002 Software Packing T1027.005 Indicator Removal from Tools T1033 System Owner/User Discovery T1036.010 Masquerade Account Name T1041 Exfiltration Over C2 Channel T1049 System Network Connections Discovery T1053.005 Scheduled Task T1056.001 Keylogging T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1069 Permission Groups Discovery T1070.004 File Deletion T1074.001 Local Data Staging T1078.002 Domain Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1090.002 External Proxy T1095 Non-Application Layer Protocol T1098.007 Additional Local or Domain Groups T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1110.002 Password Cracking T1136.001 Local Account T1203 Exploitation for Client Execution T1204.001 Malicious Link T1218.011 Rundll32 T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1552.001 Credentials In Files T1555.003 Credentials from Web Browsers T1560.001 Archive via Utility T1564.003 Hidden Window T1566.002 Spearphishing Link T1574.001 DLL

Recent activity

APT 3.3.5 HTTP Backend Audit https:// packetstorm.news/files/239627
mastodon · Nov 5, 2026

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.