Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0022
MITRE ATT&CK Group

APT3 (G0022)

Gothic PandaPirpiUPS TeamBuckeyeThreat Group-0110TG-0110
ShareXLinkedInRedditHN

[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.(Citation: Symantec Buckeye)

▪Techniques used (44)

T1053.005Scheduled TaskT1104Multi-Stage ChannelsT1110.002Password Cracking

▪Software used (6)

S0165OSInfomalwareS0111schtaskstool
G0022 on MITRE ATT&CK →
T1564.003Hidden Window
T1555.003Credentials from Web Browsers
T1059.003Windows Command Shell
T1016System Network Configuration Discovery
T1049System Network Connections Discovery
T1090.002External Proxy
T1218.011Rundll32
T1027Obfuscated Files or Information
T1566.002Spearphishing Link
T1098.007Additional Local or Domain Groups
T1204.001Malicious Link
T1041Exfiltration Over C2 Channel
T1552.001Credentials In Files
T1074.001Local Data Staging
T1078.002Domain Accounts
T1005Data from Local System
T1203Exploitation for Client Execution
T1021.002SMB/Windows Admin Shares
T1574.001DLL
T1087.001Local Account
T1070.004File Deletion
T1083File and Directory Discovery
T1546.008Accessibility Features
T1560.001Archive via Utility
T1082System Information Discovery
T1059.001PowerShell
T1543.003Windows Service
T1003.001LSASS Memory
T1547.001Registry Run Keys / Startup Folder
T1021.001Remote Desktop Protocol
T1057Process Discovery
T1095Non-Application Layer Protocol
T1069Permission Groups Discovery
T1018Remote System Discovery
T1056.001Keylogging
T1036.010Masquerade Account Name
T1027.002Software Packing
T1136.001Local Account
T1105Ingress Tool Transfer
T1033System Owner/User Discovery
T1027.005Indicator Removal from Tools
S0013PlugXmalware
S0349LaZagnetool
S0063SHOTPUTmalware
S0166RemoteCMDmalware

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.