Cyber Resilience

Threat actor · all actors

APT3G0022 state-contractor

🇨🇳 CN · MSS · Guangdong Bureau

aka APT3, Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110

Last updated: 2026-08-22

2attributed CVEs
69ATT&CK techniques
4.4IDF score (tooling uniqueness)
0exclusive CVEs
2017–2021years active

About this actor

[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.(Citation: Symantec Buckeye)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0022

CrowdStrikenation-animal names

Gothic Panda

Mandiant / genericAPT numbering

APT3

Unclassifiedno scheme matched

PirpiUPS TeamBuckeyeThreat Group-0110TG-0110

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 69 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2017-6328 6.98.80.02142017-08-11see CVE
CVE-2020-6789 5.87.80.00352021-03-25see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-448 / 6970%
CM-641 / 6959%
CM-234 / 6949%
AC-333 / 6948%
AC-231 / 6945%
AC-631 / 6945%
CM-730 / 6943%
CA-727 / 6939%
SI-327 / 6939%
AC-524 / 6935%
IA-224 / 6935%
AC-422 / 6932%
SC-721 / 6930%
SI-721 / 6930%
CM-520 / 6929%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category