type: intrusion-set
spec_version: 2.1
id: intrusion-set--fb366179-766c-4a4a-afa1-52bff1fd601c
created: 2017-05-31T21:31:58.518Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0027
external_id: G0027
source_name: Threat Group-3390
description: (Citation: Dell TG-3390)(Citation: Hacker News LuckyMouse June 2018)
source_name: TG-3390
description: (Citation: Dell TG-3390)(Citation: Nccgroup Emissary Panda May 2018)(Citation: Hacker News LuckyMouse June 2018)
source_name: Emissary Panda
description: (Citation: Gallagher 2015)(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)(Citation: Trend Micro Iron Tiger April 2021)
source_name: Iron Tiger
description: (Citation: Hacker News LuckyMouse June 2018)(Citation: Trend Micro Iron Tiger April 2021)
source_name: Linen Typhoon
description: (Citation: Microsoft Naming Conventions Frequently Updated)
source_name: APT27
description: (Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)(Citation: Trend Micro Iron Tiger April 2021)
source_name: LuckyMouse
description: (Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)(Citation: Trend Micro Iron Tiger April 2021)
source_name: BRONZE UNION
description: (Citation: SecureWorks BRONZE UNION June 2017)(Citation: Nccgroup Emissary Panda May 2018)
source_name: Earth Smilodon
description: (Citation: Trend Micro Iron Tiger April 2021)
source_name: SecureWorks BRONZE UNION June 2017
description: Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
url: https://www.secureworks.com/research/bronze-union
source_name: Dell TG-3390
description: Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
url: https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
source_name: Unit42 Emissary Panda May 2019
description: Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
url: https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
source_name: Gallagher 2015
description: Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”. Retrieved January 25, 2016.
url: http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/
source_name: Hacker News LuckyMouse June 2018
description: Khandelwal, S. (2018, June 14). Chinese Hackers Carried Out Country-Level Watering Hole Attack. Retrieved August 18, 2018.
url: https://thehackernews.com/2018/06/chinese-watering-hole-attack.html
source_name: Securelist LuckyMouse June 2018
description: Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018.
url: https://securelist.com/luckymouse-hits-national-data-center/86083/
source_name: Trend Micro Iron Tiger April 2021
description: Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
url: https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html
source_name: Trend Micro DRBControl February 2020
description: Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
url: https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf
source_name: Microsoft Naming Conventions Frequently Updated
description: Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025.
url: https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming
source_name: Nccgroup Emissary Panda May 2018
description: Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
url: https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-15T20:24:59.798Z
name: Threat Group-3390
description: [Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)
aliases: Threat Group-3390
Earth Smilodon
TG-3390
Emissary Panda
BRONZE UNION
APT27
Iron Tiger
LuckyMouse
Linen Typhoon
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 3.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Daniyal Naeem, BT Security
Kyaw Pyiyt Htet, @KyawPyiytHtet
x_mitre_domains: enterprise-attack