Threat Group-3390
Threat Group-3390 is a China-linked espionage threat actor assessed by SecureWorks CTU as likely based in the People’s Republic of China. It is also tracked as APT27 and BRONZE UNION, with aliases including Emissary Panda, LuckyMouse/Lucky Mouse, Linen Typhoon, Iron Tiger, Iron Taurus, Earth Smilodon, Circle Typhoon, Bowser, Red Phoenix, Wekby2, DEV-0322, TG-3390, and Threat Group-3390. CTU described the group as active and capable, focused on gathering defense, security, and political intelligence. Reported targeting includes aerospace, government, defense, technology, energy, manufacturing, banking, academic, media, and utilities organizations. The content specifically notes targeting of Turkish government, banking, and academic networks, U.S.-based defense manufacturers, a governmental entity in the Middle East via Exchange ProxyLogon exploitation, and use of SharePoint vulnerabilities by China-linked groups including Linen Typhoon to steal intellectual property. Observed tradecraft includes strategic web compromises and exploitation of vulnerable Internet-facing services, including JBOSS-based service desk software and Exchange ProxyLogon. After access, the group rapidly collected credentials, escalated privileges, deployed multiple web shells, conducted internal reconnaissance, moved laterally, established persistence, staged data, and exfiltrated archives. CTU reported use of OwaAuth, China Chopper, Rcmd, Wrapikatz, Netview, and a likely Kekeo-derived credential abuse tool, along with Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor. The group has used command-line interfaces, PowerShell, WMI to execute binaries, and native Windows features such as PowerShell remoting and WinRM. The content attributes several ATT&CK-style behaviors to Threat Group-3390: delivery via malicious email attachments; persistence through Registry Run keys under Software\Microsoft\Windows\CurrentVersion\Run; reading and decrypting stored Registry values; compiling archives of file types of interest from victim directories; locally staging encrypted archives; moving staged encrypted archives to previously compromised Internet-facing servers with China Chopper before exfiltration; deleting logs and exfiltrated file archives; and disabling IIS HTTP logging with appcmd before deleting logs. CTU also reported password-protected RAR archives renamed as .tmp files for staging and later exfiltration. More recently, the content describes APT27 as PRC-nexus and states it used Gemini to accelerate development of fleet management tooling for an operational relay box (ORB) network, an anonymizing infrastructure using 4G or 5G SIM cards on routers and mobile gateways to launder traffic through residential IP space.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Academia & Research
- Independent Media
- Financial Services
- Health Care Equipment & Services
- Military
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
61 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
46 malware families attributed to this actor across reporting.
41 additional families tracked in Mallory.
Associated vulnerabilities
33 CVEs this actor has used in observed campaigns. 33 of them exploited in the wild.
China-based attackers used the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East shortly after the vulnerability was publicly revealed and patched in July 2025... ToolShell affects on-premise SharePoint servers and gives an attacker unauthenticated access to vulnerable servers, allowing them to remotely execute code and access all content and file systems.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
Microsoft has not confirmed exploitation of CVE-2025-53771; however, CISA assesses exploitation is likely because it can be chained with CVE-2025-53770 to bypass previously disclosed vulnerabilities CVE-2025-49704 and CVE-2025-49706.
"During multiple incident response investigations, NCC Group found that a vulnerable version of SolarWinds Serv-U server appeared to be the initial access used by TA505... The vulnerability being exploited is known as CVE-2021-35211."
28 more CVEs tied to this actor tracked in Mallory.
Observables
144 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PRC-linked actor using Gemini to accelerate development of ORB fleet-management tooling for anonymized operational infrastructure.
Uses Gemini to accelerate development of fleet management tooling for an ORB network used to anonymize and launder traffic through residential IP space.
Using AI to accelerate development of ORB network management infrastructure used to anonymize and conceal attack origin.
Exploited SharePoint vulnerabilities to steal intellectual property.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.