Threat Group-3390Threat actor
- APT27
- bronze union
- budworm
- earth smilodon
- emissary panda
- g0027
- greedytaotie
- group 35
- iron taurus
- iron tiger
- Linen Typhoon
- lucky mouse
- LuckyMouse
- red phoenix
- shore castle
- temp.hippo
- tg-3390
- ziptoken
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.From MITRE ATT&CK
Last reported 22 days ago, by SecurityWeek3 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1005Data from Local System
“Data from Local System”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1036Masquerading
“Masquerading: Match Legitimate Name”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks“Last year, the Chinese state-sponsored groups Linen Typhoon and Violet Typhoon were seen exploiting two SharePoint vulnerabilities dubbed ToolShell as zero-days at least two weeks before public disclosure.”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“An open directory with similar Chinese-origin toolset was linked to APT27 (Emissary Panda), whereas an updated TOSHIS loader used by Tropic Trooper to deploy AdaptixC2 with custom GitHub listener.”
-
Introducing the REF5961 intrusion set“…ing formatting and underlying behavior that aligns with previous research attributed to a Chinese-speaking threat actor referred to as LuckyMouse (APT27, EmissaryPanda).”
Indicators in its reports
named in the reports above- decoded.avast[.]ioin 1 report
- hxxp://president[.]mn/en/ebooksheets.phpin 1 report
- president[.]mnin 1 report
- www.president[.]mnin 1 report
- datacenter.gov[.]mnin 1 report
- hxxps://intranet.gov[.]mn/upload.phpin 1 report
- intranet.gov[.]mnin 1 report
- 45.90.58[.]103in 1 report
- 185.195.237[.]123in 1 report
- 185.82.217[.]164in 1 report
- 195.123.245[.]79in 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.