State-backedChina MITRE G0027

APT27

Also known as GreedyTaotie, TG-3390, EMISSARY PANDA, TEMP.Hippo, Red Phoenix, Budworm, Group 35, ZipToken, Iron Tiger, BRONZE UNION, Lucky Mouse, G0027, Iron Taurus, Earth Smilodon, Circle Typhoon, Linen Typhoon, SHORE CASTLE, Threat Group-3390, LuckyMouse

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.

Targets: Government, Private sector, United States, United Kingdom, France, Japan, Taiwan, India, Canada, China, Thailand, Israel, Australia, South Korea, Russia

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.004 LSA Secrets T1005 Data from Local System T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.006 Windows Remote Management T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1027.015 Compression T1030 Data Transfer Size Limits T1033 System Owner/User Discovery T1046 Network Service Discovery T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.002 At T1055.012 Process Hollowing T1056.001 Keylogging T1059.001 PowerShell T1059.003 Windows Command Shell T1068 Exploitation for Privilege Escalation T1070.004 File Deletion T1070.005 Network Share Connection Removal T1071.001 Web Protocols T1074.001 Local Data Staging T1074.002 Remote Data Staging T1078 Valid Accounts T1087.001 Local Account T1105 Ingress Tool Transfer T1112 Modify Registry T1119 Automated Collection T1133 External Remote Services T1140 Deobfuscate/Decode Files or Information T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1199 Trusted Relationship T1203 Exploitation for Client Execution T1204.002 Malicious File T1210 Exploitation of Remote Services T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control T1555.005 Password Managers T1560.002 Archive via Library T1566.001 Spearphishing Attachment T1567.002 Exfiltration to Cloud Storage T1574.001 DLL T1583.001 Domains T1588.002 Tool T1588.003 Code Signing Certificates T1608.001 Upload Malware T1608.002 Upload Tool T1608.004 Drive-by Target T1685.001 Disable or Modify Windows Event Log

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.