Gothic Panda 1
Overview
APT3 (Gothic Panda) is a Chinese state-sponsored threat group attributed to the Ministry of State Security. This BTLO Threat Intelligence lab tasks the analyst with building a comprehensive Threat Actor Report covering APT3’s known TTPs, operations, CVEs, network IOCs, and MITRE ATT&CK mappings. 25 questions spanning OSINT research, MITRE Navigator, VirusTotal, and primary threat intel sources. Genuinely one of the harder intel labs on the platform — Q5 alone took three hours.
Threat Actor Report
As part of this lab, a full Threat Actor Report was completed using the SBT CTI Team template, covering executive summary, timeline of activity, MITRE ATT&CK table, IOCs, and CVE analysis.
Investigation
Threat Actor Background
APT3 became active in 2007 and was first formally identified by the threat intelligence community in 2014 via FireEye reporting. The group primarily targeted U.S. sectors including Aerospace, Defense, High Technology, Telecommunications, and Transportation before shifting focus to political organisations in Hong Kong as part of the Buckeye campaign.
Attribution rests on Chinese-language artifacts in tooling, operational timing aligned with China Standard Time, and target selection mapping to MSS strategic priorities.
Known Operations
Operation Clandestine Fox (April–May 2014) leveraged a zero-day in Internet Explorer, exploiting a use-after-free vulnerability (CVE-2014-1776) affecting IE versions 6–11 via drive-by download.
Operation Double Tap (November–December 2014) was a spear-phishing campaign exploiting CVE-2014-6332 — the Windows OLE Automation array vulnerability nicknamed “Unicorn” by IBM researcher Robert Freeman. The bug is a Use-After-Free enabling RCE. Double Tap also leveraged CVE-2014-4113 (Windows kernel privilege escalation).
Operation Clandestine Wolf (June–July 2015) exploited a heap-based buffer overflow in Adobe Flash Player (CVE-2015-3113), delivered via spear-phishing.
Hacking Team Disclosure
Following the July 2015 Hacking Team leak, APT3 rapidly weaponised CVE-2015-5119 (Adobe Flash zero-day). Subsequently, CVE-2015-5122 was used to attack Japan, with the Kaba backdoor (a PlugX variant commonly used by Chinese APTs) deployed as the post-exploitation implant.
MITRE ATT&CK TTPs
Execution: The APT3 downloader verifies SYSTEM privileges using cmd.exe /C whoami. Persistence is established via Scheduled Tasks with task name mysc: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".
Persistence: APT3 places scripts in the Startup folder (T1547.001). They also replace sethc.exe (Sticky Keys binary) for persistence — Event Triggered Execution: Accessibility Features (T1546.008).
Defense Evasion: MSBuild.exe is used as a LOLBin to proxy code execution — Trusted Developer Utilities Proxy Execution (T1127.001). UAC is bypassed via Bypass User Account Control (T1548.002).
Credential Access: A custom tool injects into lsass.exe and triggers with the argument dig to dump credentials (T1003.001).
Lateral Movement: Files are copied over SMB/Windows Admin Shares (T1021.002). RDP is also used to interact with compromised systems (T1021.001).
Malware & Tools
| Tool | Type | MITRE ID | Notes |
|---|---|---|---|
| PlugX | RAT | S0013 | Primary RAT — also known as Kaba |
| SHOTPUT | Backdoor | — | Custom backdoor, aka CookieCutter |
| COOKIECUTTER | Loader | — | Browser exploitation and payload delivery |
| SOGU | RAT | — | Used for sustained access and exfiltration |
Downloader binary (Operation Double Tap): MD5: 5c08957f05377004376e6a622406f9aa Compiled: 2014-11-18 10:49:23Z
Network IOCs
Domain first observed November 17, 2014 in Operation Double Tap: www[.]securitywap[.]com — last seen 2014-11-20 — IP 192[.]184[.]60[.]229
IOCs
| Type | Value |
|---|---|
| Domain | www[.]securitywap[.]com |
| Domain | inform[.]bedircati[.]com |
| Domain | pn[.]lamb-site[.]com |
| Domain | walterclean[.]com |
| Domain | join[.]playboysplus[.]com |
| Domain | www[.]apple-net[.]com |
| Domain | www[.]mmfhlele[.]com |
| Domain | www[.]olk4[.]com |
| Domain | update[.]olk4[.]com |
| Domain | infosecvn[.]com |
| Domain | www[.]freesmadav[.]com |
| Domain | update[.]freesmadav[.]com |
| IP | 192[.]184[.]60[.]229 |
| IP | 104[.]151[.]248[.]173 |
| IP | 154[.]223[.]150[.]105 |
| IP | 43[.]251[.]182[.]114 |
| IP | 185[.]239[.]226[.]61 |
| IP | 167[.]88[.]180[.]132 |
| IP | 45[.]251[.]240[.]55 |
| MD5 | 5c08957f05377004376e6a622406f9aa |
| CVE | CVE-2014-6332 |
| CVE | CVE-2014-4113 |
| CVE | CVE-2014-1776 |
| CVE | CVE-2015-3113 |
| CVE | CVE-2015-5119 |
| CVE | CVE-2015-5122 |
| CVE | CVE-2017-0143 |
| CVE | CVE-2019-0703 |