Threat Group-3390 - G0027

Created: 2017-05-31T21:31:58.518Z

Modified: 2023-03-29T16:53:17.235Z

Contributors: Daniyal Naeem, BT Security,Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Threat Group-3390,Earth Smilodon,TG-3390,Emissary Panda,BRONZE UNION,APT27,Iron Tiger,LuckyMouse

Description

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

Techniques Used

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Threat Group-3390 has registered domains for C2.(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.005|Password Managers|

Threat Group-3390 obtained a KeePass database from a compromised host.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|