Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT27 · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT27

  • GreedyTaotie
  • TG-3390
  • EMISSARY PANDA
  • TEMP.Hippo
  • Red Phoenix
  • Budworm
  • Group 35
  • ZipToken

state sponsor · UnknownMITRE G0027 ↗

APT27 — ATT&CK roseAP

attack rose · 57 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE7 new CVEs: CVE-2019-0604, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2025-49704 +1 more

Analyst brief

misp-galaxy + mitre-attack

A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.

Observed targets (as stated by the sources)

15 countries · 5 sectors
United StatesUnited KingdomFranceJapanTaiwanIndiaCanadaChinaThailandIsraelAustraliaSouth KoreaRussiaIranTürkiyeAssessed origin: China

assessed origin · Chinaobserved targets · 15

countries · 15

  • United States
  • United Kingdom
  • France
  • Japan
  • Taiwan
  • India
  • Canada
  • China
  • Thailand
  • Israel
  • Australia
  • South Korea
  • Russia
  • Iran
  • Türkiye

sectors · 5

  • Government
  • Private sector
  • Technology
  • Government, Administration
  • Defense

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

57 techniques · 13 of 15 tactics

  1. Resource development

    6 techniques

  2. Initial access

    5 techniques

  3. Execution

    6 techniques

  4. Persistence

    4 techniques

  5. Privilege escalation

    2 techniques

  6. Stealth

    9 techniques

  7. Defense impairment

    2 techniques

  8. Credential access

    4 techniques

  9. Discovery

    7 techniques

  10. Lateral movement

    2 techniques

  11. Collection

    6 techniques

  12. Command and control

    2 techniques

  13. Exfiltration

    2 techniques

select a technique

Arsenal

12 malware · 12 tools
Malware
Malware · 12ATT&CK
PlugXS0013 ↗
ASPXSpyS0073 ↗
Cobalt StrikeS0154 ↗
gh0st RATS0032 ↗
China ChopperS0020 ↗
HTTPBrowserS0070 ↗
SysUpdateS0663 ↗
HyperBroS0398 ↗
ZxShellS0412 ↗
RCSessionS0662 ↗
ClamblingS0660 ↗
PandoraS0664 ↗
Tools
Tools · 12ATT&CK
NetS0039 ↗
SysteminfoS0096 ↗
gsecdumpS0008 ↗
MimikatzS0002 ↗
ImpacketS0357 ↗
certutilS0160 ↗
TasklistS0057 ↗
netstatS0104 ↗
ipconfigS0100 ↗
pwdumpS0006 ↗
NBTscanS0590 ↗
Windows Credential EditorS0005 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to APT27

3 on CISA KEV
  1. CVE-2019-0604KEV2026-10-17
    1. “We believe the adversary exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell.”

      cited as exploiting · named nearby · source: unit42.paloaltonetworks.com ↗ · 2026-10-17

  2. CVE-2025-49704KEV2026-10-17
    1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  3. CVE-2025-49706KEV2026-10-17
    1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  4. CVE-2021-268582026-10-17
    1. “Exploitation of recent vulnerabilities ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ) in Microsoft Exchange Server”

      attributed by a report · named nearby · source: trendmicro.com ↗ · 2026-10-17

  5. CVE-2021-270652026-10-17
    1. “Exploitation of recent vulnerabilities ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ) in Microsoft Exchange Server”

      attributed by a report · named nearby · source: trendmicro.com ↗ · 2026-10-17

  6. CVE-2021-268572026-10-17
    1. “Exploitation of recent vulnerabilities ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ) in Microsoft Exchange Server”

      attributed by a report · named nearby · source: trendmicro.com ↗ · 2026-10-17

  7. CVE-2021-268552026-10-17
    1. “Exploitation of recent vulnerabilities ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ) in Microsoft Exchange Server”

      attributed by a report · named nearby · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Iron Tiger's SysUpdate Reappears, Adds Linux TargetingTrend Micro ↗
  2. 2019A Peek into BRONZE UNION's ToolboxDell Secureworks ↗
  3. 2018LuckyMouse hits national data center to organize country-level waterholing campaignKaspersky ↗

Take it with you

keyless · no signup

References

27 sources
  1. 1.i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Lo…
  2. 2.web.archive.org/web/20140129192702/https://www.scmagazineuk.com/iran-a…
  3. 3.labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron…
  4. 4.bitdefender.com/files/News/CaseStudies/study/185/Bitdefender-Business-…
  5. 5.cfr.org/interactive/cyber-operations/iron-tiger
  6. 6.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-hacked-gov…
  7. 7.secureworks.com/research/bronze-union
  8. 8.newsroom.trendmicro.com/blog/operation-iron-tiger-attackers-shift-east-asia-un…
  9. 9.secureworks.com/research/threat-group-3390-targets-organizations-for-c…
  10. 10.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-e…
  11. +17 more in the JSON record

Track APT27 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.