Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.1 The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.234
- Dell TG-3390
- SecureWorks BRONZE UNION June 2017
- Securelist LuckyMouse June 2018
- Trend Micro DRBControl February 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Threat Group-3390 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Earth Smilodon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TG-3390 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Emissary Panda | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BRONZE UNION | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | APT27 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Iron Tiger | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | LuckyMouse | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Linen Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1030 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| also_known_as | 人面马 | — → … | 60 | src_0e0b2199-b766-47ad-af5a-891db001f83e |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.004 | LSA Secrets | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.006 | Windows Remote Management | — |
| T1027.002 | Software Packing | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1030 | Data Transfer Size Limits | — |
| T1033 | System Owner/User Discovery | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.002 | At | — |
| T1055.012 | Process Hollowing | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1070.005 | Network Share Connection Removal | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1087.001 | Local Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1119 | Automated Collection | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1505.003 | Web Shell | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1555.005 | Password Managers | — |
| T1560.002 | Archive via Library | — |
| T1566.001 | Spearphishing Attachment | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1574.001 | DLL | — |
| T1583.001 | Domains | — |
| T1588.002 | Tool | — |
| T1588.003 | Code Signing Certificates | — |
| T1608.001 | Upload Malware | — |
| T1608.002 | Upload Tool | — |
| T1608.004 | Drive-by Target | — |
| T1685.001 | Disable or Modify Windows Event Log | — |
Aliases
APT27 · BRONZE UNION · Earth Smilodon · Emissary Panda · Iron Tiger · Linen Typhoon · LuckyMouse · TG-3390 · Threat Group-3390 · 人面马
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.