Home / Threat actors / Threat Group-3390

Threat Group-3390 G0027

🔔 Create alert

Also known as: Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

8

associated CVEs

69

Techniques

24

Malware and tools

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.

Ransomware operations linked to this group ransomware.live

pandora via Pandora

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-27065 High · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2021-26858 High · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2021-26857 High · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2021-26855 Critical · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2019-0604 Critical · 9.8 KEV Ransomware Microsoft SharePoint Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2018-0798 High · 8.8 KEV Microsoft Office Memory Corruption Vulnerability

“Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.”

CVE-2017-0213 High · 7.3 KEV Ransomware Microsoft Windows Privilege Escalation Vulnerability

“Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.”

CVE-2014-6324 High · 8.8 KEV Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

“Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.”

Techniques by tactic

Resource Development

T1583.001 Domains T1588.002 Tool T1588.003 Code Signing Certificates T1608.001 Upload Malware T1608.002 Upload Tool T1608.004 Drive-by Target

Initial Access

T1078 Valid Accounts T1133 External Remote Services T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1199 Trusted Relationship T1566.001 Spearphishing Attachment

Execution

T1047 Windows Management Instrumentation T1053.002 At T1059.001 PowerShell T1059.003 Windows Command Shell T1203 Exploitation for Client Execution T1204.002 Malicious File T1574.001 DLL

Persistence

T1053.002 At T1078 Valid Accounts T1112 Modify Registry T1133 External Remote Services T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.002 At T1055.012 Process Hollowing T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control

Stealth

T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1027.015 Compression T1055.012 Process Hollowing T1070.004 File Deletion T1070.005 Network Share Connection Removal T1078 Valid Accounts T1140 Deobfuscate/Decode Files or Information T1574.001 DLL

Defense Impairment

T1112 Modify Registry T1685.001 Disable or Modify Windows Event Log

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.004 LSA Secrets T1056.001 Keylogging T1555.005 Password Managers

Discovery

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1087.001 Local Account

Lateral Movement

T1021.006 Windows Remote Management T1210 Exploitation of Remote Services

Collection

T1005 Data from Local System T1056.001 Keylogging T1074.001 Local Data Staging T1074.002 Remote Data Staging T1119 Automated Collection T1560.002 Archive via Library

Command and Control

T1071.001 Web Protocols T1105 Ingress Tool Transfer

Exfiltration

T1030 Data Transfer Size Limits T1567.002 Exfiltration to Cloud Storage

Malware and tools

ASPXSpyMalwareS0073
China ChopperMalwareS0020
ClamblingMalwareS0660
Cobalt StrikeMalwareS0154
gh0st RATMalwareS0032
HTTPBrowserMalwareS0070
HyperBroMalwareS0398
PandoraMalwareS0664
PlugXMalwareS0013
RCSessionMalwareS0662
SysUpdateMalwareS0663
ZxShellMalwareS0412
certutilToolS0160
gsecdumpToolS0008
ImpacketToolS0357
ipconfigToolS0100
MimikatzToolS0002
NBTscanToolS0590
NetToolS0039
netstatToolS0104
pwdumpToolS0006
SysteminfoToolS0096
TasklistToolS0057
Windows Credential EditorToolS0005

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.