Threat actor · all actors
Threat Group-3390G0027 state
🇨🇳 CN
aka Threat Group-3390, Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon, GreedyTaotie, TEMP.Hippo, Red Phoenix, Budworm, Group 35, ZipToken, Lucky Mouse, G0027, Iron Taurus, Circle Typhoon
Last updated: 2026-07-03
About this actor
[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)
Source: MITRE ATT&CK
Activity timeline
- 2026 — 3 CVE published
- 2022 — 1 KEV added
- 2017 — 1 CVE published
- 2010 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2010-0738 KEV | 10.0 | 5.3 | 0.9746 | 2010-04-28 | see CVE |
CVE-2017-15303 | 5.5 | 7.8 | 0.0155 | 2017-10-16 | see CVE |
CVE-2026-21236 | 5.5 | 7.8 | 0.0042 | 2026-02-10 | see CVE |
CVE-2026-31635 | 5.5 | 7.5 | 0.0082 | 2026-04-24 | see CVE |
CVE-2026-45585 | 3.5 | 6.8 | 0.0125 | 2026-05-20 | see CVE |
T1003T1003.001T1003.002T1003.004T1005T1012T1016T1018T1021T1021.006T1027T1027.002T1027.013T1027.015T1030T1033T1046T1047T1049T1053T1053.002T1055T1055.012T1056T1056.001T1059T1059.001T1059.003T1068T1070T1070.004T1070.005T1071T1071.001T1074T1074.001T1074.002T1078T1087T1087.001T1105T1112T1119T1133T1140T1189T1190T1195T1195.002T1199T1203T1204T1204.002T1210T1505T1505.003T1543T1543.003T1547T1547.001T1548T1548.002T1555T1555.005T1560T1560.002T1566T1566.001T1567T1567.002T1574T1574.001T1583T1583.001T1588T1588.002T1588.003T1608T1608.001T1608.002T1608.004T1685T1685.001
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 51 / 83 | 61% |
CM-6 | 45 / 83 | 54% |
CM-2 | 41 / 83 | 49% |
SI-3 | 38 / 83 | 46% |
AC-6 | 37 / 83 | 45% |
AC-3 | 34 / 83 | 41% |
CM-7 | 33 / 83 | 40% |
AC-2 | 32 / 83 | 39% |
CA-7 | 30 / 83 | 36% |
SI-7 | 26 / 83 | 31% |
AC-5 | 25 / 83 | 30% |
IA-2 | 25 / 83 | 30% |
SI-2 | 25 / 83 | 30% |
CM-5 | 24 / 83 | 29% |
RA-5 | 24 / 83 | 29% |
Co-occurring actors
- IndigoZebra 2 shared CVEs
- Operation Dream Job 2 shared CVEs
- Ke3chang 1 shared CVEs
- TA505 1 shared CVEs
Similar actors
Similar TTPs
- menuPass 0.42
- APT32 0.38
- Dragonfly 0.38
- OilRig 0.37
- Wizard Spider 0.34
Overlapping CVEs
- IndigoZebra 0.40
- Operation Dream Job 0.33
- Ke3chang 0.20
- TA505 0.20
Active in same years
- APT29 3.00
- Sandworm Team 3.00
- Naikon 2.00
- Equation 2.00
- Scarlet Mimic 2.00
Same nation-state
- Night Dragon 1.00
- FunnyDream 1.00
- Operation Wocao 1.00
- C0017 1.00
- Cutting Edge 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00