Threat Actor Profile
High
APT
Description
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)
Confidence Score
Known Aliases
Threat Group-3390
Earth Smilodon
TG-3390
Emissary Panda
BRONZE UNION
APT27
Iron Tiger
LuckyMouse
Linen Typhoon
Tags
mitre-attack
stix-2.1
intrusion-set
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (57)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Threat Group-3390',
'Earth Smilodon',
'TG-3390',
'Emissary Panda',
'BRONZE UNION',
'APT27',
'Iron Tiger',
'LuckyMouse',
'Linen Typhoon'],
'created': '2017-05-31T21:31:58.518Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[Threat Group-3390](https://attack.mitre.org/groups/G0027) is '
'a Chinese threat group that has extensively used strategic '
'Web compromises to target victims.(Citation: Dell TG-3390) '
'The group has been active since at least 2010 and has '
'targeted organizations in the aerospace, government, defense, '
'technology, energy, manufacturing and gambling/betting '
'sectors.(Citation: SecureWorks BRONZE UNION June '
'2017)(Citation: Securelist LuckyMouse June 2018)(Citation: '
'Trend Micro DRBControl February 2020)',
'external_references': [{'external_id': 'G0027',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G0027'},
{'description': '(Citation: Dell TG-3390)(Citation: '
'Hacker News LuckyMouse June 2018)',
'source_name': 'Threat Group-3390'},
{'description': '(Citation: Dell TG-3390)(Citation: '
'Nccgroup Emissary Panda May '
'2018)(Citation: Hacker News '
'LuckyMouse June 2018)',
'source_name': 'TG-3390'},
{'description': '(Citation: Gallagher 2015)(Citation: '
'Nccgroup Emissary Panda May '
'2018)(Citation: Securelist '
'LuckyMouse June 2018)(Citation: '
'Hacker News LuckyMouse June '
'2018)(Citation: Unit42 Emissary '
'Panda May 2019)(Citation: Trend '
'Micro Iron Tiger April 2021)',
'source_name': 'Emissary Panda'},
{'description': '(Citation: Hacker News LuckyMouse '
'June 2018)(Citation: Trend Micro '
'Iron Tiger April 2021)',
'source_name': 'Iron Tiger'},
{'description': '(Citation: Microsoft Naming '
'Conventions Frequently Updated)',
'source_name': 'Linen Typhoon'},
{'description': '(Citation: Nccgroup Emissary Panda '
'May 2018)(Citation: Securelist '
'LuckyMouse June 2018)(Citation: '
'Hacker News LuckyMouse June '
'2018)(Citation: Trend Micro Iron '
'Tiger April 2021)',
'source_name': 'APT27'},
{'description': '(Citation: Securelist LuckyMouse '
'June 2018)(Citation: Hacker News '
'LuckyMouse June 2018)(Citation: '
'Trend Micro Iron Tiger April 2021)',
'source_name': 'LuckyMouse'},
{'description': '(Citation: SecureWorks BRONZE UNION '
'June 2017)(Citation: Nccgroup '
'Emissary Panda May 2018)',
'source_name': 'BRONZE UNION'},
{'description': '(Citation: Trend Micro Iron Tiger '
'April 2021)',
'source_name': 'Earth Smilodon'},
{'description': 'Counter Threat Unit Research Team. '
'(2017, June 27). BRONZE UNION '
'Cyberespionage Persists Despite '
'Disclosures. Retrieved July 13, '
'2017.',
'source_name': 'SecureWorks BRONZE UNION June 2017',
'url': 'https://www.secureworks.com/research/bronze-union'},
{'description': 'Dell SecureWorks Counter Threat Unit '
'Threat Intelligence. (2015, August '
'5). Threat Group-3390 Targets '
'Organizations for Cyberespionage. '
'Retrieved August 18, 2018.',
'source_name': 'Dell TG-3390',
'url': 'https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage'},
{'description': 'Falcone, R. and Lancaster, T. (2019, '
'May 28). Emissary Panda Attacks '
'Middle East Government Sharepoint '
'Servers. Retrieved July 9, 2019.',
'source_name': 'Unit42 Emissary Panda May 2019',
'url': 'https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/'},
{'description': 'Gallagher, S.. (2015, August 5). '
'Newly discovered Chinese hacking '
'group hacked 100+ websites to use as '
'“watering holes”. Retrieved January '
'25, 2016.',
'source_name': 'Gallagher 2015',
'url': 'http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/'},
{'description': 'Khandelwal, S. (2018, June 14). '
'Chinese Hackers Carried Out '
'Country-Level Watering Hole Attack. '
'Retrieved August 18, 2018.',
'source_name': 'Hacker News LuckyMouse June 2018',
'url': 'https://thehackernews.com/2018/06/chinese-watering-hole-attack.html'},
{'description': 'Legezo, D. (2018, June 13). '
'LuckyMouse hits national data center '
'to organize country-level '
'waterholing campaign. Retrieved '
'August 18, 2018.',
'source_name': 'Securelist LuckyMouse June 2018',
'url': 'https://securelist.com/luckymouse-hits-national-data-center/86083/'},
{'description': 'Lunghi, D. and Lu, K. (2021, April '
'9). Iron Tiger APT Updates Toolkit '
'With Evolved SysUpdate Malware. '
'Retrieved November 12, 2021.',
'source_name': 'Trend Micro Iron Tiger April 2021',
'url': 'https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html'},
{'description': 'Lunghi, D. et al. (2020, February). '
'Uncovering DRBControl. Retrieved '
'November 12, 2021.',
'source_name': 'Trend Micro DRBControl February 2020',
'url': 'https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf'},
{'description': 'Microsoft. (2025, September 8). How '
'Microsoft names threat actors. '
'Retrieved September 10, 2025.',
'source_name': 'Microsoft Naming Conventions '
'Frequently Updated',
'url': 'https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming'},
{'description': 'Pantazopoulos, N., Henry T. (2018, '
'May 18). Emissary Panda – A '
'potential new malicious tool. '
'Retrieved June 25, 2018.',
'source_name': 'Nccgroup Emissary Panda May 2018',
'url': 'https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/'}],
'id': 'intrusion-set--fb366179-766c-4a4a-afa1-52bff1fd601c',
'modified': '2025-10-15T20:24:59.798Z',
'name': 'Threat Group-3390',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.3.0',
'x_mitre_contributors': ['Daniyal Naeem, BT Security',
'Kyaw Pyiyt Htet, @KyawPyiytHtet'],
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '3.0'}