Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.
- ATT&CK ID
- G0027
- Origin
- China
- Weather family
- Typhoon
- Techniques
- 47
- Tools
- 24
Also tracked as Earth Smilodon · TG-3390 · Emissary Panda · BRONZE UNION · APT27 · Iron Tiger · LuckyMouse · Linen Typhoon
Vulnerabilities it has exploited
- CVE-2014-6324 Microsoft Kerberos Key Distribution Center (KDC)Unscored · exploited in the wild
- CVE-2017-0213 Microsoft WindowsUnscored · exploited in the wild
- CVE-2018-0798 Microsoft OfficeUnscored · exploited in the wild
- CVE-2019-0604 Microsoft SharePointUnscored · exploited in the wild
- CVE-2021-26855 Microsoft Exchange ServerUnscored · exploited in the wild
- CVE-2021-26857 Microsoft Exchange ServerUnscored · exploited in the wild
- CVE-2021-26858 Microsoft Exchange ServerUnscored · exploited in the wild
- CVE-2021-27065 Microsoft Exchange ServerUnscored · exploited in the wild
Techniques
Resource Development
Acquire InfrastructureObtain CapabilitiesStage Capabilities
Initial Access
Valid AccountsExternal Remote ServicesDrive-by CompromiseExploit Public-Facing ApplicationSupply Chain CompromiseTrusted RelationshipPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobValid AccountsModify RegistryExternal Remote ServicesServer Software ComponentCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionExploitation for Privilege EscalationValid AccountsCreate or Modify System ProcessBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationProcess InjectionIndicator RemovalValid AccountsDeobfuscate/Decode Files or InformationHijack Execution Flow
Defense Impairment
Modify RegistryDisable or Modify Tools
Credential Access
OS Credential DumpingInput CaptureCredentials from Password Stores
Discovery
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryAccount Discovery
Lateral Movement
Remote ServicesExploitation of Remote Services
Collection
Data from Local SystemInput CaptureData StagedAutomated CollectionArchive Collected Data
Command and Control
Application Layer ProtocolIngress Tool Transfer
Exfiltration
Data Transfer Size LimitsExfiltration Over Web Service
Software
ASPXSpy · China Chopper · Clambling · Cobalt Strike · HTTPBrowser · HyperBro · Impacket · Mimikatz · NBTscan · Net · Pandora · PlugX · RCSession · SysUpdate · Systeminfo · Tasklist · Windows Credential Editor · ZxShell · certutil · gh0st RAT · gsecdump · ipconfig · netstat · pwdump