{
  "id": "threat-group-3390",
  "name": "Threat Group-3390",
  "aliases": [
    "Earth Smilodon",
    "TG-3390",
    "Emissary Panda",
    "BRONZE UNION",
    "APT27",
    "Iron Tiger",
    "LuckyMouse",
    "Linen Typhoon"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Chinese group",
      "src": [
        "mitre-g0027"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2010,
      "src": [
        "mitre-g0027"
      ],
      "conf": "medium",
      "note": "At least 2010"
    },
    {
      "k": "attack_id",
      "v": "G0027",
      "src": [
        "mitre-g0027"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.",
      "src": [
        "mitre-g0027"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 57,
      "src": [
        "mitre-g0027"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ASPXSpy, certutil, China Chopper, Clambling, Cobalt Strike, gh0st RAT, gsecdump, HTTPBrowser, HyperBro, Impacket, ipconfig, Mimikatz, NBTscan, Net, netstat, Pandora, PlugX, pwdump, RCSession, Systeminfo and 4 more",
      "src": [
        "mitre-g0027"
      ],
      "conf": "high",
      "note": "24 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0027)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/threat-group-3390.html",
  "sources": {
    "mitre-g0027": {
      "title": "Threat Group-3390, Group G0027",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0027/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}