Threat intelligence / Group

Threat Group-3390

[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

81 recorded

Relationships

uses

to Archive via Library

Technique

uses

to ASPXSpy

Malware

uses

to At

Technique

uses

to Automated Collection

Technique

uses

to Bypass User Account Control

Technique

uses

to certutil

Tool

uses

to China Chopper

Malware

uses

to Clambling

Malware

uses

to Cobalt Strike

Malware

uses

to Code Signing Certificates

Technique

uses

to Compression

Technique

uses

to Compromise Software Supply Chain

Technique

uses

to Data from Local System

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Windows Event Log

Technique

uses

to DLL

Technique

uses

to Domains

Technique

uses

to Drive-by Compromise

Technique

uses

to Drive-by Target

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to File Deletion

Technique

uses

to gh0st RAT

Malware

uses

to gsecdump

Tool

uses

to HTTPBrowser

Malware

uses

to HyperBro

Malware

uses

to Impacket

Tool

uses

to Ingress Tool Transfer

Technique

uses

to ipconfig

Tool

uses

to Keylogging

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to LSA Secrets

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Mimikatz

Tool

uses

to Modify Registry

Technique

uses

to NBTscan

Tool

uses

to Net

Tool

uses

to netstat

Tool

uses

to Network Service Discovery

Technique

uses

to Network Share Connection Removal

Technique

uses

to Pandora

Malware

uses

to Password Managers

Technique

uses

to PlugX

Malware

uses

to PowerShell

Technique

uses

to Process Hollowing

Technique

uses

to pwdump

Tool

uses

to Query Registry

Technique

uses

to RCSession

Malware

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Data Staging

Technique

uses

to Remote System Discovery

Technique

uses

to Security Account Manager

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Systeminfo

Tool

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to SysUpdate

Malware

uses

to Tasklist

Tool

uses

to Tool

Technique

uses

to Trusted Relationship

Technique

uses

to Upload Malware

Technique

uses

to Upload Tool

Technique

uses

to Valid Accounts

Technique

uses

to Web Protocols

Technique

uses

to Web Shell

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Credential Editor

Tool

uses

to Windows Management Instrumentation

Technique

uses

to Windows Remote Management

Technique

uses

to Windows Service

Technique

uses

to ZxShell

Malware

20 external

References

mitre-attack

G0027

open

Threat Group-3390

—

TG-3390

—

Emissary Panda

—

Iron Tiger

—

Linen Typhoon

—

APT27

—

LuckyMouse

—

BRONZE UNION

—

Earth Smilodon

—

SecureWorks BRONZE UNION June 2017

https://www.secureworks.com/research/bronze-union

open

Dell TG-3390

https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage

open

Unit42 Emissary Panda May 2019

https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/

open

Gallagher 2015

http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/

open

Hacker News LuckyMouse June 2018

https://thehackernews.com/2018/06/chinese-watering-hole-attack.html

open

Securelist LuckyMouse June 2018

https://securelist.com/luckymouse-hits-national-data-center/86083/

open

Trend Micro Iron Tiger April 2021

https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html

open

Trend Micro DRBControl February 2020

https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf

open

Microsoft Naming Conventions Frequently Updated

https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming

open

Nccgroup Emissary Panda May 2018

https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/

open