APT3

APT3, also known as the UPS Team, is a highly sophisticated threat group suspected to be based in China and attributed to the Chinese Ministry of State Security (MSS) and Boyusec. This threat actor targets sectors including Aerospace and Defense, Construction and Engineering, High Tech, Telecommunications, and Transportation, aligning with areas highlighted by China's most recent Five Year Plan. APT3's malicious activities support China's political, economic, diplomatic, and military goals, making it not just another cyber threat group but an asset of the MSS. Companies victimized by APT3 are urged to adjust their defense strategies against this formidable adversary. The group has demonstrated advanced capabilities such as using browser-based exploits as zero-days (e.g., Internet Explorer, Firefox, and Adobe Flash Player) and creating their version of EternalSynergy, called UPSynergy. In the Bemstour case, it was assumed that APT3 sniffed the EternalRomance exploit from network traffic and later upgraded it to the equivalent of EternalSynergy using an additional APT3 vulnerability. The phishing emails used by APT3 are usually generic in nature, almost appearing to be spam, and they have been associated with malware like SHOTPUT, COOKIECUTTER, and SOGU. Once APT3 gains access to a target network, they work swiftly and proficiently at enumerating and moving laterally to maintain their access. Their command and control (CnC) infrastructure is difficult to track due to little overlap across campaigns. Similar to APT3’s activity in Operation Clandestine Wolf, the URLs redirect to JavaScript profilers and a malicious Adobe Flash file. APT3's activities underscore the significant threat posed by state-sponsored cyber actors and highlight the need for robust cybersecurity defenses.