ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G0027threat actor

Threat Group-3390

a.k.a. Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.

MITRE ATT&CK ↗

Linked entities · 24

usesT1068Exploitation for Privilege Escala…usesT1030Data Transfer Size Limits usesT1190Exploit Public-Facing Application usesT1046Network Service Discovery usesT1053.002At usesT1055.012Process Hollowing usesT1074.001Local Data Staging usesT1203Exploitation for Client Execution usesT1567.002Exfiltration to Cloud Storage usesT1003.001LSASS Memory usesT1059.003Windows Command Shell usesT1555.005Password Managers usesS0039Net usesT1566.001Spearphishing Attachment usesS0096Systeminfo usesT1012Query Registry usesT1003.004LSA Secrets usesS0008gsecdump usesT1027.015Compression usesT1204.002Malicious File usesS0013PlugX usesS0073ASPXSpy usesS0154Cobalt Strike usesS0002Mimikatz