Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies.
In short
Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies. The Justice Department charged two men it calls APT27 actors, alleging profit-driven hacking from 2013 to 2024.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT27 | MITRE ATT&CK associated-group name; also used by the US Department of Justice (5 March 2025), Germany BfV (2022), Belgium (2022) and CERT-EU with ENISA (2023)[1, 8, 11, 13, 14] |
| Threat Group-3390 | Main name on the MITRE ATT&CK group page G0027[1] |
| TG-3390 | MITRE ATT&CK associated-group name; CERT-EU and ENISA list it as TG 3390[1, 14] |
| Emissary Panda | MITRE ATT&CK associated-group name; also listed by the US Department of Justice and CERT-EU with ENISA[1, 8, 14] |
| BRONZE UNION | MITRE ATT&CK associated-group name; also listed by the US Department of Justice and CERT-EU with ENISA[1, 8, 14] |
| Iron Tiger | MITRE ATT&CK associated-group name; also listed by the US Department of Justice and CERT-EU with ENISA[1, 8, 14] |
| LuckyMouse | MITRE ATT&CK associated-group name; the US Department of Justice writes "Lucky Mouse"[1, 8] |
| Earth Smilodon | MITRE ATT&CK associated-group name[1] |
| Linen Typhoon | MITRE ATT&CK associated-group name[1] |
| Silk Typhoon | US Department of Justice press release of 5 March 2025 (not on the MITRE list)[8] |
| UTA0178 | US Department of Justice press release of 5 March 2025 (not on the MITRE list)[8] |
| UNC 5221 | US Department of Justice press release of 5 March 2025 (not on the MITRE list)[8] |
| ZipToken, Group 35, TEMP.Hippo | CERT-EU and ENISA publication JP-23-01 of 15 February 2023 (not on the MITRE list)[14] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK 31 July 2026 (page last modified)
Describes Threat Group-3390 as a Chinese threat group that has extensively used strategic web compromises, active since at least 2010, targeting aerospace, government, defense, technology, energy, manufacturing and gambling/betting.[1]
Germany BfV 26 January 2022
Reported an ongoing cyber espionage campaign by APT27 using HyperBro against German companies, with Exchange and Zoho flaws as entry points since March 2021. Says APT27 has been active since at least 2010.[11, 12]
Belgium FPS Foreign Affairs 18 July 2022
Said activity against the Belgian FPS Interior can be linked to the hacker groups known as APT27, APT30 and APT31, assessed as undertaken by Chinese APT groups, and urged China to act.[13]
CERT-EU and ENISA 15 February 2023
Drew attention to APT27 and five other APT groups conducting malicious cyber activities against business and governments in the EU.[14]
CERT-EU 1 July 2024 (brief date)
Reported that the BfV annual report (released 17 June) named China's APT27 among state-backed espionage actors.[15]
US Department of the Treasury 17 January 2025
Sanctioned Yin Kecheng and described him as affiliated with the PRC Ministry of State Security. The release does not use the name APT27.[10]
US Department of Justice 5 March 2025
Unsealed two indictments charging "APT27 actors" Yin Kecheng and Zhou Shuai over alleged for-profit intrusions, in the case of Yin dating back to 2013. Says the APT27 group to which they belong is also known by the aliases listed under Names.[8]
US Department of Justice 5 March 2025
Alleges Yin, Zhou and co-conspirators exploited vulnerabilities, installed malware such as PlugX, stole data and brokered it from August 2013 to December 2024. Says motives were financial and only some customers had PRC government or military ties.[8]
US Department of the Treasury 5 March 2025
Sanctioned Zhou Shuai and his company Shanghai Heiying. Says Zhou was a data broker since at least 2018 and that a 2020 set of requirements almost certainly originated from the CCP's intelligence services. The release does not use the name APT27.[9]
US Department of State 5 March 2025
Announced reward offers of up to 2 million US dollars each for information on Yin Kecheng and Zhou Shuai (as reported in the Justice and Treasury releases; the State page itself would not open).[8, 9]
Sources differ on who the group works for. MITRE ATT&CK calls it Chinese. The US Department of Justice (5 March 2025) says Yin Kecheng and Zhou Shuai were profit-driven and sold data to customers of whom only some had PRC government or military links. The US Treasury (17 January 2025) says Yin is affiliated with the Ministry of State Security, and (5 March 2025) says requirements given to Zhou in 2020 almost certainly came from the CCP's intelligence services. Sources also differ on names: MITRE lists Linen Typhoon, while the Justice Department lists Silk Typhoon, UTA0178 and UNC 5221. For Belgium (18 July 2022), APT27 is linked only to activity against the FPS Interior, while CERT-EU and ENISA list APT27 together with APT30, APT31 and GALLIUM. The Justice Department details are allegations; defendants are presumed innocent.
Each entry is attributed to the group by the sources cited.
The Justice Department alleges Yin, Zhou and co-conspirators ran intrusions between August 2013 and December 2024.[8]
The Treasury says Zhou Shuai has acted as a data broker since at least 2018.[9]
The Treasury says Zhou brokered the sale of documents stolen from a US cleared defense contractor.[9]
The BfV says attackers have used Exchange and Zoho ADSelfService Plus flaws as entry points since March 2021.[11]
Belgium linked activity against its FPS Interior to APT27, APT30 and APT31.[13]
CERT-EU and ENISA published JP-23-01 naming APT27.[14]
CERT-EU says the BfV annual report named China's APT27 among espionage actors.[15]
The Justice Department alleges Yin took part in the hack of the US Treasury.[8]
The US Treasury sanctioned Yin Kecheng.[10]
MITRE last modified its group page.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 26 January 2022 | Germany BfV | Public advisoryCyber brief on APT27 and HyperBro, with indicators of compromise and a YARA detection rule for companies.[11, 12] |
| 18 July 2022 | Belgium FPS Foreign Affairs | Public statementLinked activity against the FPS Interior to APT27, APT30 and APT31 and urged China to act.[13] |
| 15 February 2023 | CERT-EU and ENISA | Joint publicationJP-23-01 on sustained activity by APT27 and five other groups, with prevention, detection and response advice.[14] |
| 17 January 2025 | US Department of the Treasury | SanctionsSanctioned Yin Kecheng, described as affiliated with the PRC Ministry of State Security.[10] |
| 5 March 2025 | US Department of Justice | Indictments and seizuresUnsealed indictments of Yin Kecheng and Zhou Shuai in the District of Columbia and seized domains, server accounts and virtual private servers.[8] |
| 5 March 2025 | US Department of the Treasury | SanctionsSanctioned Zhou Shuai and Shanghai Heiying Information Technology Company, Limited.[9] |
| 5 March 2025 | US Department of State | Reward offersUp to 2 million US dollars each for information leading to the arrest and conviction of Yin Kecheng and Zhou Shuai (Transnational Organized Crime Rewards Program).[8, 9] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Drive-by Compromise T1189
MITRE says the group has extensively used strategic web compromises to target victims.[1]
Exploit Public-Facing Application T1190
MITRE lists SharePoint and Exchange Server flaws; the BfV names Exchange and Zoho flaws as entry points since March 2021.[1, 11]
Phishing: Spearphishing Attachment T1566.001
MITRE says it has used email to deliver malicious attachments.[1]
Supply Chain Compromise: Compromise Software Supply Chain T1195.002
MITRE says it compromised the Able Desktop installer to reach victims.[1]
Trusted Relationship T1199
MITRE says it has compromised third party service providers to reach victims.[1]
External Remote Services T1133
MITRE says it uses VPN profiles to access networks, and used OWA account credentials it had obtained to try to regain access when evicted.[1]
HyperBro In-memory backdoor
MITRE describes it as a custom in-memory backdoor used by the group; the BfV reported it in the 2022 campaign against German companies.[2, 11]
PlugX Remote access tool
MITRE says it is used by multiple threat groups; the Justice Department names PlugX as malware installed for persistent access.[3, 8]
SysUpdate Backdoor
MITRE says the group has used this C++ backdoor since at least 2020.[4]
RCSession Backdoor
MITRE says it has been used since at least 2018 by Mustang Panda and by the group.[5]
Clambling Modular backdoor
MITRE says the group has used this C++ backdoor since at least 2017.[7]
China Chopper Web shell
MITRE says it is used by several threat groups and lists it among the group's software.[6, 1]
ASPXSpy Web shell
MITRE says the group used a modified version called ASPXTool.[1]
HTTPBrowser Backdoor
MITRE says the group's self-extracting archives install HTTPBrowser or PlugX on other victims in a network.[1]
CERT-EU and ENISA advise an asset inventory and a patch policy that covers hardware and software exposed to the internet. The BfV named Exchange and Zoho flaws as entry points.
Counters T1190
CERT-EU and ENISA advise email filtering and user awareness training.
Counters T1566.001
The BfV published a YARA detection rule and indicators so companies can look for HyperBro infections.
Counters T1574.001
Customers can find internet-facing mail, VPN and web servers that need patching, the kind of systems this group has been reported to use as entry points.
Customers can follow reported activity from China-linked groups and check it against their own sector.
Customers can look for stolen credentials and data from their organization that may be offered for sale.
Customers can watch for lookalike domains and fake login pages that imitate their organization.
MITRE ATT&CK describes Threat Group-3390 (APT27) as a Chinese threat group active since at least 2010. The US Department of Justice (5 March 2025) calls Yin Kecheng and Zhou Shuai "APT27 actors" in indictments that allege profit-driven hacking.
MITRE ATT&CK lists Emissary Panda, LuckyMouse, Iron Tiger, BRONZE UNION, TG-3390, Earth Smilodon and Linen Typhoon as associated names. The Justice Department lists most of the same names and adds Silk Typhoon, UTA0178 and UNC 5221, so sources differ on the full alias list.
MITRE lists aerospace, government, defense, technology, energy, manufacturing and gambling/betting. The BfV reported attacks on German companies, Belgium linked activity to its FPS Interior, and the Justice Department lists US technology firms, think tanks, law firms, defense contractors, local governments, health care systems and universities.
MITRE lists strategic web compromises, flaws in internet-facing servers such as SharePoint and Exchange, spearphishing attachments and compromised service providers. The BfV named Exchange and Zoho flaws as entry points in 2022.
Sources differ. MITRE calls it Chinese. The Justice Department says the two men charged were profit-driven and only some customers had PRC government or military links, while the Treasury says one of them is affiliated with the Ministry of State Security. These are allegations.
Patch internet-facing mail, VPN and web servers, turn on multi-factor authentication, limit outbound traffic from servers, control third-party access, and use the BfV detection rule to check for HyperBro.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.