Início / Grupos de ameaça / Threat Group-3390

Threat Group-3390 G0027

🔔 Criar alerta

Também conhecido como: Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

8

CVEs associadas

69

Técnicas

24

Malwares e ferramentas

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.

Operações de ransomware ligadas a este grupo ransomware.live

pandora via Pandora

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-27065 Alta · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2021-26858 Alta · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2021-26857 Alta · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2021-26855 Crítica · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2019-0604 Crítica · 9.8 KEV Ransomware Microsoft SharePoint Remote Code Execution Vulnerability

“Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.”

CVE-2018-0798 Alta · 8.8 KEV Microsoft Office Memory Corruption Vulnerability

“Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.”

CVE-2017-0213 Alta · 7.3 KEV Ransomware Microsoft Windows Privilege Escalation Vulnerability

“Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.”

CVE-2014-6324 Alta · 8.8 KEV Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

“Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.”

Técnicas por tática

Desenvolvimento de recursos

T1583.001 Domains T1588.002 Tool T1588.003 Code Signing Certificates T1608.001 Upload Malware T1608.002 Upload Tool T1608.004 Drive-by Target

Acesso inicial

T1078 Valid Accounts T1133 External Remote Services T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1199 Trusted Relationship T1566.001 Spearphishing Attachment

Execução

T1047 Windows Management Instrumentation T1053.002 At T1059.001 PowerShell T1059.003 Windows Command Shell T1203 Exploitation for Client Execution T1204.002 Malicious File T1574.001 DLL

Persistência

T1053.002 At T1078 Valid Accounts T1112 Modify Registry T1133 External Remote Services T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.002 At T1055.012 Process Hollowing T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control

Furtividade

T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1027.015 Compression T1055.012 Process Hollowing T1070.004 File Deletion T1070.005 Network Share Connection Removal T1078 Valid Accounts T1140 Deobfuscate/Decode Files or Information T1574.001 DLL

Comprometimento de defesas

T1112 Modify Registry T1685.001 Disable or Modify Windows Event Log

Acesso a credenciais

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.004 LSA Secrets T1056.001 Keylogging T1555.005 Password Managers

Descoberta

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1087.001 Local Account

Movimento lateral

T1021.006 Windows Remote Management T1210 Exploitation of Remote Services

Coleta

T1005 Data from Local System T1056.001 Keylogging T1074.001 Local Data Staging T1074.002 Remote Data Staging T1119 Automated Collection T1560.002 Archive via Library

Comando e controle

T1071.001 Web Protocols T1105 Ingress Tool Transfer

Exfiltração

T1030 Data Transfer Size Limits T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

ASPXSpyMalwareS0073
China ChopperMalwareS0020
ClamblingMalwareS0660
Cobalt StrikeMalwareS0154
gh0st RATMalwareS0032
HTTPBrowserMalwareS0070
HyperBroMalwareS0398
PandoraMalwareS0664
PlugXMalwareS0013
RCSessionMalwareS0662
SysUpdateMalwareS0663
ZxShellMalwareS0412
certutilFerramentaS0160
gsecdumpFerramentaS0008
ImpacketFerramentaS0357
ipconfigFerramentaS0100
MimikatzFerramentaS0002
NBTscanFerramentaS0590
NetFerramentaS0039
netstatFerramentaS0104
pwdumpFerramentaS0006
SysteminfoFerramentaS0096
TasklistFerramentaS0057
Windows Credential EditorFerramentaS0005

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.