APT27 — Threat Actors — SecurityStudies.info

News fetched Nov 13, 00:01 UTC

Cyber threats / Threat actors

Profile

Also known as: BRONZE UNION, Budworm, Circle Typhoon, Earth Smilodon, EMISSARY PANDA, G0027, GreedyTaotie, Group 35, Iron Taurus, Iron Tiger, Linen Typhoon, Lucky Mouse, LuckyMouse, Red Phoenix, SHORE CASTLE, TEMP.Hippo, TG-3390, Threat Group-3390, ZipToken

A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.

Related profiles: TiltedTemple

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 57

Resource Development

T1583.001Domains T1588.002Tool T1588.003Code Signing Certificates T1608.001Upload Malware T1608.002Upload Tool T1608.004Drive-by Target

Initial Access

T1078Valid Accounts T1133External Remote Services T1189Drive-by Compromise T1190Exploit Public-Facing Application T1195.002Compromise Software Supply Chain T1199Trusted Relationship T1566.001Spearphishing Attachment

Execution

T1047Windows Management Instrumentation T1053.002At T1059.001PowerShell T1059.003Windows Command Shell T1203Exploitation for Client Execution T1204.002Malicious File T1574.001DLL

Persistence

T1112Modify Registry T1505.003Web Shell T1543.003Windows Service T1547.001Registry Run Keys / Startup Folder

Privilege Escalation

T1055.012Process Hollowing T1068Exploitation for Privilege Escalation T1548.002Bypass User Account Control

Stealth

T1027.002Software Packing T1027.013Encrypted/Encoded File T1027.015Compression T1070.004File Deletion T1070.005Network Share Connection Removal T1140Deobfuscate/Decode Files or Information

Defense Impairment

T1685.001Disable or Modify Windows Event Log

Credential Access

T1003.001LSASS Memory T1003.002Security Account Manager T1003.004LSA Secrets T1056.001Keylogging T1555.005Password Managers

Discovery

T1012Query Registry T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1046Network Service Discovery T1049System Network Connections Discovery T1087.001Local Account

Lateral Movement

T1021.006Windows Remote Management T1210Exploitation of Remote Services

Collection

T1005Data from Local System T1074.001Local Data Staging T1074.002Remote Data Staging T1119Automated Collection T1560.002Archive via Library

Command and Control

T1071.001Web Protocols T1105Ingress Tool Transfer

Exfiltration

T1030Data Transfer Size Limits T1567.002Exfiltration to Cloud Storage

Incidents attributed

No incident in the register is attributed to this actor.

In the news

Updated Cyber Threat Actor Naming System
Google Threat Intelligence · Jul 24, 2026

Targets

Elsewhere: Canada, France, United Kingdom, Israel, Iran, Russia, Türkiye, United States

Sectors: Defense, Government, Government, Administration, Private sector, Technology

Relevance to the EU

EU relevance: High

Targets EU member states (France) as well as 7 Asia-Pacific countries

39 EU cooperation projects in the Asia-Pacific countries this actor targets:

Trade & Investment

11

Research & Innovation

5

Infrastructure & Transport

5

Digital & ICT

4

Development Cooperation

4

Peace & Security

2

Governance & Rule of Law

2

Education & Skills

2

Threats to the EU →

References

Sources: MISP, MITRE