MITRE ATT&CKgroup
G0027 Threat Group-3390
- Domain
- enterprise
- Aliases
- Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon
- Version
- 3.0
- Created
- 2017-05-31
Description
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.
Related
Uses · MITRE ATT&CK (81)
- T1685.001 Disable or Modify Windows Event Log sub-technique
- T1027.015 Compression sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- S0663 SysUpdate software (malware)
- S0664 Pandora software (malware)
- S0662 RCSession software (malware)
- S0660 Clambling software (malware)
- S0590 NBTscan software (tool)
- T1608.001 Upload Malware sub-technique
- T1608.002 Upload Tool sub-technique
- T1608.004 Drive-by Target sub-technique
- T1555.005 Password Managers sub-technique
- T1588.002 Tool sub-technique
- T1588.003 Code Signing Certificates sub-technique
- T1583.001 Domains sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1074.002 Remote Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1195.002 Compromise Software Supply Chain sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1003.004 LSA Secrets sub-technique
- T1087.001 Local Account sub-technique
- T1560.002 Archive via Library sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.002 Security Account Manager sub-technique
References
- https://www.secureworks.com/research/bronze-union SecureWorks BRONZE UNION June 2017
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage Dell TG-3390
- https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ Unit42 Emissary Panda May 2019
- http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/ Gallagher 2015
- https://thehackernews.com/2018/06/chinese-watering-hole-attack.html Hacker News LuckyMouse June 2018
- https://securelist.com/luckymouse-hits-national-data-center/86083/ Securelist LuckyMouse June 2018
- https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html Trend Micro Iron Tiger April 2021
- https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf Trend Micro DRBControl February 2020
- https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming Microsoft Naming Conventions Frequently Updated
- https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/ Nccgroup Emissary Panda May 2018