Threat Intelligence Tarot
Vol. II · 107
China (MSS Boyusec contractor)
G0022★★★★★
risk 4/5
✦ The Vanished Hand ✦
APT3
Buckeye · UPS Team · Gothic Panda · TG-0110
DefenseTelecommunicationsHong Kong dissidentsUS technology firms
Active since ~2010 · Espionage, Capability acquisition
The Vanished Hand collected exploits the way royal physicians once collected venoms — quietly, methodically, with full state backing. When attribution closed in, the operators dissolved into the MSS structure they had always served.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Operation Clandestine Wolf (Internet Explorer 0-day, 2015)
- ◆Boyusec / Wu Yingzhuo / Dong Hao DOJ indictment (2017)
- ◆Hong Kong pro-democracy targeting
- ◆Repurposed NSA EternalSynergy exploit (2016-2017)
Defenses
- ▸Patch management with priority for browser and document handlersCIS Control 7 ↗
- ▸Application allowlisting on workstationsCIS Control 2 ↗
- ▸Threat intelligence integration tracking nation-state contractor TTPsNIST CSF: DE.AE ↗
- ▸Phishing-resistant MFA on remote accessNIST SP 800-63B ↗
Reversed: Their Weakness
Operations security failures gave investigators the seams: shared infrastructure, reused exploits, and a single criminal front company linking everything to MSS Guangzhou. The 2017 DOJ indictment was their final public exposure.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.