Adversary Emulation with MITRE ATT&CK

Chapter 15. APT3 Emulation Plan

This chapter explores APT3, a cyber espionage group based in China. Renowned for its sophisticated tactics and a strategic shift toward Hong Kong political entities in 2015, indicating broader geopolitical goals, APT3 is recognized by multiple aliases, including Gothic Panda, Pirpi, and Buckeye. Initially uncovered in 2010 (refer to Chapter 1), this cyber espionage group is notorious for its state-sponsored activities associated with China’s Ministry of State Security. Notably, around 2015, APT3 redirected its focus from American targets to political entities in Hong Kong, marking a realignment with broader geopolitical objectives. Although the group surfaced on cybersecurity researchers’ radar in 2010, there is a possibility that its operations commenced even earlier. Characterized by a blend of sophistication and stealth, APT3’s campaigns encompass spearphishing attacks, zero-day vulnerabilities exploitation, and the deployment of custom malware and backdoors to sustain persistence in compromised systems.

APT3 achieved significant notoriety during a series of campaigns from 2014 to 2015, including Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. These campaigns underscored the group’s strategic cyber espionage approach—selecting targets that would yield the most valuable intelligence for its state-sponsored objectives.

The technical capabilities of APT3 have evolved. Initially recognized for leveraging various exploit ...