Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0027
MITRE ATT&CK Group

Threat Group-3390 (G0027)

Earth SmilodonTG-3390Emissary PandaBRONZE UNIONAPT27Iron TigerLuckyMouseLinen Typhoon
ShareXLinkedInRedditHN

[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

▪Techniques used (57)

T1068Exploitation for Privilege EscalationT1030Data Transfer Size LimitsT1190Exploit Public-Facing Application

▪Software used (24)

S0039NettoolS0096Systeminfotool
G0027 on MITRE ATT&CK →
T1046Network Service Discovery
T1053.002At
T1055.012Process Hollowing
T1074.001Local Data Staging
T1203Exploitation for Client Execution
T1567.002Exfiltration to Cloud Storage
T1003.001LSASS Memory
T1059.003Windows Command Shell
T1555.005Password Managers
T1566.001Spearphishing Attachment
T1012Query Registry
T1003.004LSA Secrets
T1027.015Compression
T1204.002Malicious File
T1033System Owner/User Discovery
T1608.001Upload Malware
T1505.003Web Shell
T1547.001Registry Run Keys / Startup Folder
T1027.013Encrypted/Encoded File
T1543.003Windows Service
T1199Trusted Relationship
T1016System Network Configuration Discovery
T1105Ingress Tool Transfer
T1056.001Keylogging
T1059.001PowerShell
T1078Valid Accounts
T1608.004Drive-by Target
T1588.002Tool
T1018Remote System Discovery
T1583.001Domains
T1189Drive-by Compromise
T1140Deobfuscate/Decode Files or Information
T1003.002Security Account Manager
T1133External Remote Services
T1005Data from Local System
T1087.001Local Account
T1195.002Compromise Software Supply Chain
T1548.002Bypass User Account Control
T1119Automated Collection
T1560.002Archive via Library
T1027.002Software Packing
T1588.003Code Signing Certificates
T1047Windows Management Instrumentation
T1071.001Web Protocols
T1070.005Network Share Connection Removal
T1021.006Windows Remote Management
T1574.001DLL
T1070.004File Deletion
T1685.001Disable or Modify Windows Event Log
T1608.002Upload Tool
T1112Modify Registry
T1074.002Remote Data Staging
T1049System Network Connections Discovery
T1210Exploitation of Remote Services
S0008gsecdumptool
S0013PlugXmalware
S0073ASPXSpymalware
S0154Cobalt Strikemalware
S0002Mimikatztool
S0357Impackettool
S0032gh0st RATmalware
S0160certutiltool
S0020China Choppermalware
S0070HTTPBrowsermalware
S0057Tasklisttool
S0104netstattool
S0663SysUpdatemalware
S0398HyperBromalware
S0412ZxShellmalware
S0662RCSessionmalware
S0100ipconfigtool
S0660Clamblingmalware
S0006pwdumptool
S0590NBTscantool
S0664Pandoramalware
S0005Windows Credential Editortool

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.