Endpoint Protection . Buckeye cyberespionage group shifts gaze from US to Hong Kong . Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. Symantec has identified additional tools used by the group, which will be discussed later. Organizations that Buckeye targeted over time, per region . Malware and tools . Buckeye uses a number of hacking tools as well as malware. Buckeye uses Backdoor.Pirpi, a remote access Trojan capable of reading, writing, and executing files and programs. As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister. RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”. OSinfo: OSInfo is a general purpose, system information gathering tool. It has the following command line argument help: ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser. This, coupled with the group’s use of zero-day exploits in the past, customized tools, and the types of organizations being targeted would suggest that Buckeye is a state-sponsored cyberespionage group