Actors/Nation-state / APT/Asia

APT27

G0027APTCN · China

AKA Group 35 · BRONZE UNION · Earth Smilodon · Iron Tiger · ZipToken · LuckyMouse · Threat Group 3390 · Budworm · Red Phoenix · Temp.Hex

CrowdStrike: EMISSARY PANDAMicrosoft: Silk TyphoonMITRE: G0027PwC: Red SylvanSecureworks: TG-3390

Targets23

Sectors11

Threat types1

GIRs covered0/480

Active since2010

Also tracked as

6 vendor names · 10 other aliases

Open Rosetta Stone

CrowdStrike

EMISSARY PANDA

Mandiant

APT27

Microsoft

Silk Typhoon

MITRE

G0027

PwC

Red Sylvan

Secureworks

TG-3390

UNATTRIBUTED ALIASESGroup 35BRONZE UNIONEarth SmilodonIron TigerZipTokenLuckyMouseThreat Group 3390BudwormRed PhoenixTemp.Hex

Victimology

Geographic footprint · 23 countries

origin · Chinatargeted countries · 23

ASIA · 13

United Arab Emirates · Israel · India · Iran · Kuwait · Kazakhstan · Philippines · Qatar · Saudi Arabia · Singapore · Thailand · Türkiye · Taiwan

AMERICAS · 3

Argentina · Canada · United States

EUROPE · 6

Germany · Spain · France · United Kingdom · Serbia · Ukraine

AFRICA · 1

Tunisia

Sectors targeted

11 of 40

Government100 actors Aerospace59 actors Healthcare47 actors Technology60 actors Telecom72 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors Private Sector (generic)29 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 40 techniques

Initial Access · 5

T1189Drive-by Compromise T1190Exploit Public-Facing Application T1195.002Compromise Software Supply Chain T1199Trusted Relationship T1566.001Spearphishing Attachment

Execution · 5

T1047Windows Management Instrumentation

Persistence · 2

T1543.003Windows Service

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 4

T1003.001LSASS Memory

Discovery · 6

T1012Query Registry T1016System Network Configuration Discovery

Lateral Movement · 2

T1021.006Windows Remote Management T1210

Collection · 3

T1005Data from Local System T1119Automated Collection

Exfiltration · 2

T1030Data Transfer Size Limits T1567.002Exfiltration to Cloud Storage

Command And Control · 2

T1071.001Web Protocols

Defense Impairment · 1

T1112Modify Registry

Stealth · 7

T1027.002Software Packing

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer40 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.002

At

T1059.001PowerShell

T1059.003Windows Command Shell

T1203Exploitation for Client Execution

T1547.001

Registry Run Keys / Startup Folder

T1003.002

Security Account Manager

T1003.004LSA Secrets

T1555.005Password Managers

T1018

Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

Exploitation of Remote Services

T1560.002

Archive via Library

T1105

Ingress Tool Transfer

T1027.015

Compression

T1055.012Process Hollowing

T1070.004File Deletion

T1070.005Network Share Connection Removal

T1078Valid Accounts

T1140Deobfuscate/Decode Files or Information