Threat Group-3390

MITRE ATT&CK: G0027 View on attack.mitre.org

Aliases: Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon, GreedyTaotie, EMISSARY PANDA, TEMP.Hippo, Red Phoenix, Budworm, Group 35, ZipToken, Lucky Mouse, Iron Taurus, Circle Typhoon, Threat Group-3390, DEV-0322, APT6, IODINE, Hippo, BOWSER, Wekby2, UNC215

First seen
2010-01-01 00:00:00
Origin
CN
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
Espionage
Related IoCs
40 (40 malicious)
Last IoC activity
2026-10-14 11:35:22
Profile updated
2026-07-07 12:31:09

Targeted industries: defense-and-aerospace government-and-public-sector technology-and-telecommunications energy-and-utilities manufacturing

Targeted regions: country_code:us country_code:gb country_code:jp country_code:de country_code:in

Context

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.

Recent IoC activity

40 malicious indicators in Maltiverse are attributed to Threat Group-3390 (G0027). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname ybupdate.me 2026-10-14 2
hostname order.myvandyke.net 2026-10-12 1
hostname ns.sportwo8.me 2026-10-12 1
hostname ns.mlnrm.com 2026-10-05 1
hostname trojan.win32.hyperbro.ag 2026-10-04 1
hostname ns.sportxx.me 2026-10-03 1
hostname multi-user.target 2026-09-24 2
file sample c65c435737ac02132d9dfeb6ec1d7d903648f61ecdda8a85b4250f064cb4673f 2026-09-24 2
file sample cc196ee155bf864071cbeec3ddcd3e2451a37d4296f53a024142c70193b9691d 2026-09-24 1
hostname jira.atlas-sian.net 2026-09-24 1
hostname oa.myvandyke.net 2026-09-18 1
hostname dev.gitlabs.me 2026-09-12 1
hostname oa.88tech.me 2026-09-11 1
file sample 09a3231a300d794010c3f400617cd0b1b7aab7141735a2b8635a8362584e196d 2026-09-06 1
file sample 3ac029e49ca71d948bfe1a7bc691967cf26cb5a731c7807d5be3cf6b579fa8ab 2026-08-27 1
file sample e24b29a1df287fe947018c33590a0b443d6967944b281b70fba7ea6556d00109 2026-08-23 1
file sample 2ada1b48457c169cf3f80e248190374102615e2c89b70e574fba4ddc09b5fcd5 2026-06-28 2
file sample 9add546cb9527f9d7e4930aaddec6e14c70d1400d0d531a9102efd4c83b27dd7 2026-02-10 1
file sample 9499eabf880a55522c1b78d5afaa9ff34ae958950627ccd15099f2e771c9b0b1 2025-11-25 1
file sample b504ab7a4a35e6deb34536d4663db696918961aadc03662b2c34e89b50ba10a1 2025-11-11 1

Detection coverage

  • 184 YARA rules
  • 816 Sigma rules

Malware & tools used

  • Exploitation for Privilege Escalation (attack-pattern)
  • Data Transfer Size Limits (attack-pattern)
  • Exploit Public-Facing Application (attack-pattern)
  • Network Service Discovery (attack-pattern)
  • At (attack-pattern)
  • Process Hollowing (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Exploitation for Client Execution (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • LSASS Memory (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Password Managers (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Query Registry (attack-pattern)
  • LSA Secrets (attack-pattern)
  • Compression (attack-pattern)
  • Malicious File (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Upload Malware (attack-pattern)
  • Web Shell (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Windows Service (attack-pattern)
  • Trusted Relationship (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)

Reports & references

  • cloud.google.com — Updated Cyber Threat Actor Naming System (report)
  • i.blackhat.com — As 22 Li To Loot Or Not To Loot That Is Not A Question (report)
  • web.archive.org — 330401 (report)
  • labs.bitdefender.com — Operation Pzchao A Possible Return Of The Iron Tiger Apt (report)
  • bitdefender.com — Bitdefender Business 2017 Whitepaper Pzchao Crea2452 En En Genericuse (report)
  • cfr.org — Iron Tiger (report)
  • bleepingcomputer.com — Chinese Cyber Espionage Group Hacked Government Data Center (report)
  • secureworks.com — Bronze Union (report)
  • Trend Micro — Operation Iron Tiger Attackers Shift East Asia United States (report)
  • secureworks.com — Threat Group 3390 Targets Organizations For Cyberespionage (report)
  • threatconnect.com — Threatconnect Discovers Chinese Apt Activity In Europe (report)
  • nccgroup.trust — Decoding Network Data From A Gh0St Rat Variant (report)
  • Kaspersky — 87914 (report)
  • paper.seebug.org — Operation%20Iron%20Tiger%20Appendix (report)
  • arstechnica.com — Newly Discovered Chinese Hacking Group Hacked 100 Websites To Use As Watering Holes (report)
  • Kaspersky — 86083 (report)
  • MITRE ATT&CK — G0027 (report)
  • secureworks.com — Bronze Union (report)
  • Palo Alto Unit 42 — Iron Taurus (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • ESET — Exchange Servers Under Siege 10 Apt Groups (report)
  • Trend Micro — Iron Tiger Apt Updates Toolkit With Evolved Sysupdate Malware Va (report)
  • Mandiant — Apt Groups (report)
  • raw.githubusercontent.com — Microsoftmapping (report)
  • Microsoft — Microsoft Threat Actor Naming (report)

External references