Threat Group-3390

APT / StateG0027 ↗
Origin🇨🇳 China
Techniques (MITRE ATT&CK)57
SourceMITRE ATT&CK
State sponsor: UnknownAttribution confidence: 50%Target categories: Government, Private sector
Targeted regions: United States · United Kingdom · France · Japan · Taiwan · India · Canada · China · Thailand · Israel +5
Also known as:Earth SmilodonTG-3390Emissary PandaBRONZE UNIONAPT27Iron TigerLuckyMouseLinen Typhoon

Vexday analysis

Threat Group-3390 (também referenciado como APT27, Emissary Panda, Iron Tiger, BRONZE UNION, Earth Smilodon e TG-3390) é um grupo de ameaça persistente avançada de origem chinesa, ativo pelo menos desde 2010. O grupo ficou conhecido pelo uso extensivo de comprometimentos estratégicos de sites para alcançar suas vítimas, tendo atuado contra organizações dos setores aeroespacial, governamental, de defesa, tecnologia, energia, manufatura e jogos de azar. Catalogado no MITRE ATT&CK sob o identificador G0027, o grupo possui 57 técnicas documentadas e 12 CVEs atribuídas a sua atuação.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity93
Impact: High
T1189T1047T1133T1068T1021.006T1005ENTRYInitial accessDrive-byCompromiseEXECExecutionWindows ManagementInstrumentationPERSPersistenceExternal RemoteServicesPRIVPrivilege escalationExploitation forPrivilege Escalat…LATLateral movementWindows RemoteManagementCOLLCollectionData from LocalSystemEXFILExfiltrationData Transfer SizeLimits

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 57

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development
DomainsToolCode Signing CertificatesUpload MalwareUpload ToolDrive-by Target
Initial access
Drive-by CompromiseExploit Public-Facing ApplicationCompromise Software Supply ChainTrusted RelationshipSpearphishing Attachment
Execution
Windows Management InstrumentationAtPowerShellWindows Command ShellExploitation for Client ExecutionMalicious File
Persistence
External Remote ServicesWeb ShellWindows ServiceRegistry Run Keys / Startup Folder
Privilege escalation
Exploitation for Privilege EscalationBypass User Account Control
Credential access
LSASS MemorySecurity Account ManagerLSA SecretsPassword Managers
Discovery
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryLocal Account
Lateral movement
Windows Remote ManagementExploitation of Remote Services
Collection
Data from Local SystemKeyloggingLocal Data StagingRemote Data StagingAutomated CollectionArchive via Library
Command and control
Web ProtocolsIngress Tool Transfer
Exfiltration
Data Transfer Size LimitsExfiltration to Cloud Storage
defense-impairment
Modify RegistryDisable or Modify Windows Event Log
stealth
Software PackingEncrypted/Encoded FileCompressionProcess HollowingFile DeletionNetwork Share Connection RemovalValid AccountsDeobfuscate/Decode Files or InformationDLL

Exploited vulnerabilities 12

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2021-26855CRITICALEPSS 100%KEVCVE-2021-27065HIGHEPSS 100%KEVCVE-2014-7169CRITICALEPSS 100%KEVCVE-2019-0604CRITICALEPSS 100%KEVCVE-2021-26857HIGHEPSS 94%KEVCVE-2018-0798HIGHEPSS 91%KEVCVE-2021-26858HIGHEPSS 90%KEVCVE-2014-6324HIGHEPSS 87%KEVCVE-2017-0213HIGHEPSS 84%KEVCVE-2016-6662EPSS 68%CVE-2017-0176EPSS 46%CVE-2019-3610MEDIUMEPSS 0%

Known infrastructure 1255

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port68.64.182.169:110Cobalt Strikethreatfox
ip:port68.64.182.169:465Cobalt Strikethreatfox
ip:port101.42.255.92:8443Cobalt Strikethreatfox
ip:port68.64.182.169:995Cobalt Strikethreatfox
ip:port68.64.182.169:7000Cobalt Strikethreatfox
ip:port68.64.182.169:8000Cobalt Strikethreatfox
ip:port68.64.182.169:7010Cobalt Strikethreatfox
ip:port8.163.59.20:22Cobalt Strikethreatfox
ip:port178.128.80.204:22Cobalt Strikethreatfox
ip:port68.64.182.169:4190Cobalt Strikethreatfox
ip:port68.64.182.169:993Cobalt Strikethreatfox
ip:port91.92.42.118:13019Cobalt Strikethreatfox
ip:port118.31.18.77:2301Cobalt Strikethreatfox
ip:port119.29.122.42:8080Cobalt Strikethreatfox
ip:port68.64.182.169:587Cobalt Strikethreatfox
ip:port119.29.122.42:80Cobalt Strikethreatfox
ip:port119.29.122.42:443Cobalt Strikethreatfox
ip:port68.64.182.169:3306Cobalt Strikethreatfox
ip:port68.64.182.169:8010Cobalt Strikethreatfox
ip:port68.64.182.169:5727Cobalt Strikethreatfox
ip:port68.64.182.169:111Cobalt Strikethreatfox
ip:port68.64.182.169:443Cobalt Strikethreatfox
ip:port68.64.182.169:8080Cobalt Strikethreatfox
ip:port159.75.123.199:21Cobalt Strikethreatfox
ip:port68.64.183.127:8090Cobalt Strikethreatfox
ip:port68.64.183.127:5555Cobalt Strikethreatfox
ip:port139.196.217.227:80Cobalt Strikethreatfox
ip:port159.75.123.199:5003Cobalt Strikethreatfox
ip:port156.239.47.245:80Cobalt Strikethreatfox
ip:port156.239.47.245:8080Cobalt Strikethreatfox

+1255 indicators in total. See them all on the IOCs page.

References

Threat Group-3390 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →