- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- Unknown
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0027 · 57 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0036 · threat-group-3390
ChinaWhat it is
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Emissary Panda, Vicious Panda, Colourful Panda, Iron Tiger, Panda
- Mandiant
- APT 6, APT27, APT6, UNC215, APT 27, TEMP.Hippo
- Microsoft
- Circle Typhoon, Linen Typhoon, DEV-0322
- MITRE ATT&CK
- G0027
- Proofpoint
- TA428
- PwC
- Red Phoenix
- Secureworks
- BRONZE UNION, TG-3390
- Talos and others
- Group 35
- Trend Micro
- Earth Smilodon
- Operations
- Operation DRBControl, Operation “DRBControl”, Operation “Iron Tiger”, Operation “LagTime IT”, Operation “PZChao”, Operation “SpoiledLegacy”, Operation “StealthyTrident”
- Other names
- Mikroceen, TiltedTemple, 1.php Group, ATK 15, BOWSER, Bronze Dudley, Budworm, Emissary Panda, APT 27, LuckyMouse, Bronze Union, GreedyTaotie, Hippo, IODINE, Iron Taurus, Lucky Mouse, LuckyMouse, SHORE CASTLE, SixLittleMonkeys, ThunderCats, Wekby2, ZipToken
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Afghanistan, Australia, Belarus, Canada, China, France, Germany, Hong Kong, India, Iran, Israel, Japan, Mongolia, Philippines, Russia, South Korea, Spain, Taiwan, Thailand, Tibet, Türkiye, Ukraine, United Kingdom, United States
- Sectors
- Aerospace, Aviation, Defense, Education, Embassies, Government, Government, Administration, IT, Manufacturing, Oil and gas, Private sector, Technology, Telecommunications, Think Tanks
Tools
The tools and malware families the sources tie to it.
- 8.t Dropper
- ASPXSpy
- Albaniiutas
- Archelaus Beta
- BYEBY
- Back Orifice
- Back Orifice 2000
- Backdoor.Oldrea
- China Chopper
- Clambling
- Cobalt Strike
- Cotx RAT
- CoughingDown
- Cyber Eye RAT
- CyberGate
- Deeper RAT
- Gh0st RAT
- HTTPBrowser
- HyperBro
- Impacket
- Microcin
- Mikroceen
- Mimikatz
- Minimo
- NBTscan
- Net
- Pandora
- PhantomNet
- PlugX
- Poison Ivy
- PoisonIvy
- RCSession
- SPACESHIP
- Socket23
- SocketPlayer
- SysUpdate
- Systeminfo
- TManger
- Tasklist
- Unknown Logger
- Virus RAT
- Windows Credential Editor
- Windows Remote Desktop
- Xpert
- Xploit
- ZxShell
- certutil
- gh0st RAT
- gsecdump
- ipconfig
- logon.dll
- logsupport.dll
- netstat
- pcaudit.bat
- pwdump
- sqllauncher.dll
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de