Article Content Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade Traditionally, the group attacked organizations in the US as well as other targets However, Buckeye’s focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong Since March 2016, the group has appeared to mostly focus on organizations in Hong Kong, sending malicious emails to targets as recently as August 4, and attempting to spread within compromised networks in order to steal information Using the combined threat intelligence of Symantec and Blue Coat Systems, we have built a clear and concise picture of how Buckeye has evolved its tactics in recent years This has allowed us to further enhance our protection capabilities against the group’s campaigns Background Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009 The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails Symantec has identified additional tools used by the group, which will be discussed later Although other zero-day attacks have been reported, they have not been confirmed by Symantec Shifting focus of attacks More recently, Symantec telemetry has revealed Backdoor.Pirpi connections from compromised computers based in Hong Kong dating back to August 2015 The infections significantly increased in number towards the end of March 2016 and the beginning of April 2016 Additional investigations discovered related malware samples and determined that targeted organizations were political entities in Hong Kong Who’s being targeted? From 2015 to date, Symantec identified approximately 82 organizations in various regions that had Buckeye tools present on their network However, this is not an accurate picture of the targets of interest to Buckeye The group casts a wide net while trawling for targets but only remains active on the networks of organizations it is interested in After these filters were applied to our data, we found a total of 17 organizations, located in Hong Kong (13), the US (3), and the UK (1) Figure 1 Buckeye victims of interest by region (2015 to date) It should be noted that this data goes back to 2015 and that the proportion of targets in Hong Kong from March 2016 would be considerably higher Up to mid-2015, Buckeye’s traditional targets were varying categories of US organizations, which match the types of victims seen in the UK Buckeye interests changed substantially around June 2015 when the group began infecting organizations in Hong Kong Infections in the UK and US ceased shortly after this time Figure 2 Many of the hacking tools are open source applications that have been patched or modified in some manner by Buckeye in an attempt to evade detection Buckeye uses Backdoor.Pirpi, a remote access Trojan capable of reading, writing, and executing files and programs Usage is: %s shareIp domain [USER INFORMATION|[USER NAME AND PASSWORD]] [/run:[COMMAND]] The commands to be passed consist of upload, download, Service (create, delete, start, stop), delete, rename, and AT PwDumpVariant: This tool imports lsremora.dll (often downloaded by the attacker as part of the toolset) and uses the GetHash export of this DLL Lazagne: A compiled Python tool that extracts passwords from various locally installed application classes, such as web browsers The full list is: chats, svn, wifi, mails, windows, database, sysadmin, and browsers Buckeye seems to target file and print servers, which makes it likely the group is looking to steal documents This, coupled with the group’s use of zero-day exploits in the past, customized tools, and the types of organizations being targeted would suggest that Buckeye is a state-sponsored cyberespionage group Protection Symantec, Norton, and Blue Coat products protect against the activities of this cyberespionage group 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade Traditionally, the group attacked organizations in the US as well as other targets However, Buckeye’s focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong Since March 2016, the group has appeared to mostly focus on organizations in Hong Kong, sending malicious emails to targets as recently as August 4, and attempting to spread within compromised networks in order to steal information Using the combined threat intelligence of Symantec and Blue Coat Systems, we have built a clear and concise picture of how Buckeye has evolved its tactics in recent years This has allowed us to further enhance our protection capabilities against the group’s campaigns Background Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009 The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails Symantec has identified additional tools used by the group, which will be discussed later Although other zero-day attacks have been reported, they have not been confirmed by Symantec Shifting focus of attacks More recently, Symantec telemetry has revealed Backdoor.Pirpi connections from compromised computers based in Hong Kong dating back to August 2015 The infections significantly increased in number towards the end of March 2016 and the beginning of April 2016 Additional investigations discovered related malware samples and determined that targeted organizations were political entities in Hong Kong Who’s being targeted? From 2015 to date, Symantec identified approximately 82 organizations in various regions that had Buckeye tools present on their network However, this is not an accurate picture of the targets of interest to Buckeye The group casts a wide net while trawling for targets but only remains active on the networks of organizations it is interested in After these filters were applied to our data, we found a total of 17 organizations, located in Hong Kong (13), the US (3), and the UK (1) Figure 1 Buckeye victims of interest by region (2015 to date) It should be noted that this data goes back to 2015 and that the proportion of targets in Hong Kong from March 2016 would be considerably higher Up to mid-2015, Buckeye’s traditional targets were varying categories of US organizations, which match the types of victims seen in the UK Buckeye interests changed substantially around June 2015 when the group began infecting organizations in Hong Kong Infections in the UK and US ceased shortly after this time Figure 2 Many of the hacking tools are open source applications that have been patched or modified in some manner by Buckeye in an attempt to evade detection Buckeye uses Backdoor.Pirpi, a remote access Trojan capable of reading, writing, and executing files and programs Usage is: %s shareIp domain [USER INFORMATION|[USER NAME AND PASSWORD]] [/run:[COMMAND]] The commands to be passed consist of upload, download, Service (create, delete, start, stop), delete, rename, and AT PwDumpVariant: This tool imports lsremora.dll (often downloaded by the attacker as part of the toolset) and uses the GetHash export of this DLL Lazagne: A compiled Python tool that extracts passwords from various locally installed application classes, such as web browsers The full list is: chats, svn, wifi, mails, windows, database, sysadmin, and browsers Buckeye seems to target file and print servers, which makes it likely the group is looking to steal documents This, coupled with the group’s use of zero-day exploits in the past, customized tools, and the types of organizations being targeted would suggest that Buckeye is a state-sponsored cyberespionage group Protection Symantec, Norton, and Blue Coat products protect against the activities of this cyberespionage group  ### Response: .