Threat Group-3390
- ID
- G0027
- Associated names
- Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
Techniques used (57)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.004 LSA Secrets
- T1005 Data from Local System
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.006 Windows Remote Management
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1030 Data Transfer Size Limits
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.002 At
- T1055.012 Process Hollowing
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1070.005 Network Share Connection Removal
- T1071.001 Web Protocols
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1087.001 Local Account
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1119 Automated Collection
- T1133 External Remote Services
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1505.003 Web Shell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1555.005 Password Managers
- T1560.002 Archive via Library
- T1566.001 Spearphishing Attachment
- T1567.002 Exfiltration to Cloud Storage
- T1574.001 DLL
- T1583.001 Domains
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1608.001 Upload Malware
- T1608.002 Upload Tool
- T1608.004 Drive-by Target
- T1685.001 Disable or Modify Windows Event Log
Software used (24)
- S0002 Mimikatz
- S0005 Windows Credential Editor
- S0006 pwdump
- S0008 gsecdump
- S0013 PlugX
- S0020 China Chopper
- S0032 gh0st RAT
- S0039 Net
- S0057 Tasklist
- S0070 HTTPBrowser
- S0073 ASPXSpy
- S0096 Systeminfo
- S0100 ipconfig
- S0104 netstat
- S0154 Cobalt Strike
- S0160 certutil
- S0357 Impacket
- S0398 HyperBro
- S0412 ZxShell
- S0590 NBTscan
- S0660 Clambling
- S0662 RCSession
- S0663 SysUpdate
- S0664 Pandora