aol.pm

Threat Group-3390

IntrusionSet · ATTACK:enterprise:G0027

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0027",
  "title": "Threat Group-3390",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0027",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--fb366179-766c-4a4a-afa1-52bff1fd601c",
  "external_id": "G0027",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:58.518Z",
  "modified": "2026-07-31T18:48:27.731Z",
  "version": "3.0",
  "aliases": [
    "Threat Group-3390",
    "Earth Smilodon",
    "TG-3390",
    "Emissary Panda",
    "BRONZE UNION",
    "APT27",
    "Iron Tiger",
    "LuckyMouse",
    "Linen Typhoon"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Threat Group-3390"
    },
    {
      "source_name": "TG-3390"
    },
    {
      "source_name": "Emissary Panda"
    },
    {
      "source_name": "Iron Tiger"
    },
    {
      "source_name": "Linen Typhoon"
    },
    {
      "source_name": "APT27"
    },
    {
      "source_name": "LuckyMouse"
    },
    {
      "source_name": "BRONZE UNION"
    },
    {
      "source_name": "Earth Smilodon"
    },
    {
      "source_name": "SecureWorks BRONZE UNION June 2017",
      "url": "https://www.secureworks.com/research/bronze-union"
    },
    {
      "source_name": "Dell TG-3390",
      "url": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
    },
    {
      "source_name": "Unit42 Emissary Panda May 2019",
      "url": "https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"
    },
    {
      "source_name": "Gallagher 2015",
      "url": "http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/"
    },
    {
      "source_name": "Hacker News LuckyMouse June 2018",
      "url": "https://thehackernews.com/2018/06/chinese-watering-hole-attack.html"
    },
    {
      "source_name": "Securelist LuckyMouse June 2018",
      "url": "https://securelist.com/luckymouse-hits-national-data-center/86083/"
    },
    {
      "source_name": "Trend Micro Iron Tiger April 2021",
      "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
    },
    {
      "source_name": "Trend Micro DRBControl February 2020",
      "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
    },
    {
      "source_name": "Microsoft Naming Conventions Frequently Updated",
      "url": "https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming"
    },
    {
      "source_name": "Nccgroup Emissary Panda May 2018",
      "url": "https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"
    }
  ]
}

Explicit source assertions (81)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0942dc11-0fcd-480a-ae4d-d571ba96331b

SecureWorks BRONZE UNION June 2017 · Profero APT27 December 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b36c1d0-d016-4c12-bf61-6dc14b29c7e0

Dell TG-3390

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11e07a59-502c-44e9-9a70-03eff1433c33

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13d8aec7-3e49-41f8-b57c-475cdc0d9632

Dell TG-3390 · Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1053.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17594ffb-af22-4cdc-8849-ca31d2019a9e

Dell TG-3390

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17af5c1a-7912-40af-b7b9-f68f0a15977d

Securelist LuckyMouse June 2018 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b45f3b5-b7a4-4424-a8ff-1b1f1c1a55d9

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b9b061b-5ead-45f3-b4cc-30d8427b0649

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21ef7a27-1019-4ced-8a09-63351bbbc150

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21f2fd40-073c-4c25-bf4e-19339ac1f99d

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26eafe5d-0ffc-48cf-ba1d-3681bdcbfaa3

SecureWorks BRONZE UNION June 2017 · Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1555.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c036695-32e2-458f-a0f1-25cd2e8b9fbd

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e45dc12-f493-42ea-829e-011ba786bef1

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30b93042-d56e-4ecf-82d8-8b287bd9c00c

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0096

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30ba627f-f567-444c-9c48-39db264ca78b

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3559da63-5706-4e5a-b130-89858c2c0f44

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36b9f594-9a27-4281-a18e-9a5e7df70ad9

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b6fc69c-9759-465a-b09c-a6161e4e2f56

Dell TG-3390

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d63e19a-2b2b-4b00-834e-c7d6d5d1f8bb

Unit42 Emissary Panda May 2019 · Securelist LuckyMouse June 2018 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d6e0a95-3265-4a0c-aee1-feff2807489b

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--412b7fbf-bc21-4373-9f2c-5f0a26482536

SecureWorks BRONZE UNION June 2017 · Dell TG-3390 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0073

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a1bfb6c-f110-4785-9dff-4c8e433bf04d

Dell TG-3390 · Profero APT27 December 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b32f8e0-ba08-45b5-bc9a-b394d99a5aba

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ce5e752-97d6-4803-a49c-0f905729a133

Talent-Jump Clambling February 2020 · SecureWorks BRONZE UNION June 2017 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565f6cdf-e29b-430d-8b42-e0b0b93fa994

Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--590756ce-b948-4d62-9608-4fadf58681f4

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5beed1ca-321a-47b7-a16c-02905ad96364

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d1d76e6-ecd8-44e7-bc90-7701788dc28e

Secureworks BRONZEUNION Feb 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--614c18a5-2cee-48ac-898d-e1b85a91e44d

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6468546f-721e-4df8-90a3-67b39a7b2834

Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64d59c09-1ecd-4711-b2b8-e46d4ffc7ede

Lunghi Iron Tiger Linux · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--658fcd28-934d-4077-b93e-89af9512de5f

Unit42 Emissary Panda May 2019 · Securelist LuckyMouse June 2018 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68d41471-49c7-4210-8d9b-2958e95feb1a

Lunghi Iron Tiger Linux · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--690c6d2a-3e02-4eb9-b835-079c50c64adf

Profero APT27 December 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69682171-e717-4af7-a24a-06a39f381641

Dell TG-3390

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a1693a7-1e85-48b6-9097-11339a987099

Dell TG-3390 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b5c6fc2-615a-46fc-80a4-9ab332159722

Dell TG-3390 · Hacker News LuckyMouse June 2018 · Securelist LuckyMouse June 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e6828ca-7567-4302-8ed7-fa5821dc5bbc

SecureWorks BRONZE UNION June 2017 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71daf1fe-a979-4cbc-bb0d-4e2d6c79274a

Dell TG-3390 · SecureWorks BRONZE UNION June 2017 · Nccgroup Emissary Panda May 2018 · Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75c3b5f6-a0ca-4afc-baad-ef19ed4317b3

Dell TG-3390 · SecureWorks BRONZE UNION June 2017 · Nccgroup Emissary Panda May 2018 · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78f237da-f58b-4849-b2ee-cf1f3f7a1a42

Dell TG-3390

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1608.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7acc1226-d784-448e-8aeb-7f58e343c4da

Gallagher 2015

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b050e9f-ab8e-4860-aae9-4a37e18efbe2

Dell TG-3390 · Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b6eac00-8a13-42e3-b533-a40314eada68

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8074dd43-75b7-432f-9e33-af3136d90c00

Lunghi Iron Tiger Linux

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83075ee3-b372-48a4-a54c-ca54afdd8c0b

Dell TG-3390 · Securelist LuckyMouse June 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88c2feed-474e-427c-a0ed-6a4e1576b145

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0104

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b38c61f-d128-4496-a15f-c91d121b39f6

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9191026d-2410-4e6d-98fe-26786a5b8bf1

Securelist LuckyMouse June 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0663

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a036174e-7bd3-4604-ba4c-c26cceb5fe67

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0398

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a05c887d-9f4b-490c-843e-e6f98641fe77

Unit42 Emissary Panda May 2019 · Securelist LuckyMouse June 2018 · Hacker News LuckyMouse June 2018 · Trend Micro DRBControl February 2020 · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0412

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7b07cff-8743-4fe9-9999-8ad32995fa95

Secureworks BRONZEUNION Feb 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a829622f-60cf-4e24-afce-fb89270e95cb

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab6a19e4-ce00-46cd-ae83-0798471e4a4a

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aec0a948-428f-4327-b466-a0472da12928

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0662

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b143e00a-062e-424a-83c2-27559ff2cdf1

Profero APT27 December 2020 · Trend Micro Iron Tiger April 2021 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2dbbb46-9659-4277-8753-c469c4bfe409

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1195.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b842af96-8422-4b23-bd17-35d123c5a9b5

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9165c4a-aac7-479d-8ad9-22c25e031a76

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b990e235-dcf4-48c7-800d-b8a10a62eda4

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0100

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c354d751-4688-49c5-9f9a-0d2bc705f645

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1560.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8c5b766-a719-43bd-988a-cb00beedbba3

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbaf6578-b0f6-4d48-86c1-bfe5089b1b1f

Trend Micro Iron Tiger April 2021 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1588.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d14513b4-9c60-49cd-88ee-0cb2ffde394a

Lunghi Iron Tiger Linux

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d226d631-b611-450e-b904-aad115bbe77a

Profero APT27 December 2020 · Trend Micro Iron Tiger April 2021 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c4e420-4e1a-420d-9d6a-08fe6d322217

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db191b70-063d-433b-a462-9f7611a5a0e2

Securelist LuckyMouse June 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1070.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc7cb17d-c3d3-4c3c-b79e-499cede49baa

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--deb55b94-e38c-4941-9ebd-8cc3343c3eae

Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1021.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df8350d6-a7a7-421d-a9e8-64d7e0cc0653

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4e2d35b-83fb-4515-b531-576acb02e1a5

SecureWorks BRONZE UNION June 2017 · Lunghi Iron Tiger Linux · Dell TG-3390 · Unit42 Emissary Panda May 2019 · Securelist LuckyMouse June 2018 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0590

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7740e58-d87c-44c4-907c-f66b88851ffc

Dell TG-3390 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8193b28-b28a-4ab7-8390-8a5bd4d851b5

SecureWorks BRONZE UNION June 2017 · Trend Micro DRBControl February 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0664

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec9574b7-95ec-4d84-b468-164e918bbffd

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1685.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef6b8690-4a9f-4910-8178-e78df631ea7d

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1608.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2e028ed-49e0-41ec-8400-8f8dc1ae6435

Dell TG-3390

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f88fcb22-698b-4901-b894-a597192c2ba3

Trend Micro Iron Tiger April 2021 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9ec1b10-f819-42d8-a4b4-ecf015999cb6

Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1074.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa8d15db-498b-45f5-8cc1-bf4cf70e2e62

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb6a8268-5a73-4ac0-8f61-439f472063d6

Dell TG-3390

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.