← All actors Recent activity

Threat Group-3390 G0027

27 · IRONTIGER · apt 27 · apt27 · bronze union · cycldek · emissary panda · goblin panda · group 35 · iron tiger · luckymouse · temp.hippo · tg-3390 · threat group 3390 · ziptoken

Indicators
291
Source reports
70
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20182026

Overview 291 indicators

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.

domain255G0027-domain.txt
ipv421G0027.json
url15G0027.json

Techniques 57 ATT&CK

Open in ATT&CK Navigator → or download the layer (57 techniques, layer 4.5)

Software 24

Principal sources 70 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

  • ICEFOG
    4 shared indicators
  • REDFOXTROT
    4 shared indicators
  • UNC215
    3 shared indicators
  • GOLDENRAT GOLDENRAT
    2 shared indicators
  • APT41 G0096
    shares ZxShell, ASPXSpy, pwdump and 1 more
  • APT39 G0087
    shares Windows Credential Editor, ASPXSpy, pwdump
  • Mustang Panda G0129
    shares RCSession, China Chopper
  • APT18 G0026
    shares HTTPBrowser

4 more in the relationship graph.

Timeline 291 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. or earlier 1 ipv4this year

    x.com/skocherhan/status/1942043295292481785

    103.243.26.213:8000

  2. or earlier 1 domainthis year

    x.com/TuringAlex/status/1977626210609049683 · trendmicro.com/en_us/research/22/l/probing-weaponized-… · virustotal.com/gui/ip-address/8.219.76.37/relations · virustotal.com/gui/file/db4497090a94d0189aa3c3f4fcee30… · otx.alienvault.com/pulse/6399f1943fb578ccb093a7b7

    unix.s3amazonbucket.com

  3. 2 url3 yrs ago

    blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage… · virustotal.com/gui/file/ce226bd1f53819d6654caf04a7bb41… · virustotal.com/gui/file/29741e60dca8a68021be35525a6b46… · virustotal.com/gui/file/7201e604359019b484f6a6ac4d8cba… · virustotal.com/gui/file/6e3c3045bb9d0db4817ad0441ee3c9… · virustotal.com/gui/file/3443bb895444c1c7fa0beab54f93a7…

    http://23.224.61.12
    http://45.32.33.17

  4. 2 ipv4, 1 url3 yrs ago

    twitter.com/felixaime/status/1698741466619838510 · virustotal.com/gui/file/12e1f50d7c9cf546c90545588bc369… · virustotal.com/gui/file/ee66ebcbe872def8373a4e5ea23f14…

    ipv4154.93.7.99:8090
    ipv438.54.119.239:443
    urlhttp://38.54.119.239

  5. 4 domain3 yrs ago

    cofense.com/blog/open-source-gh0st-rat-still-haunti… · otx.alienvault.com/pulse/6448506f7a10b2c157ec8fc4

    api.youkesdt.asia
    cloudservicesdevc.tk
    datacache.cloudservicesdevc.tk
    youkesdt.asia

  6. 10 domain3 yrs ago

    trendmicro.com/en_us/research/23/c/iron-tiger-sysupdat… · otx.alienvault.com/pulse/63ff5a60ca3dccd68551ba17

    88tech.me
    atlas-sian.net
    dev.gitlabs.me
    gitlabs.me
    jira.atlas-sian.net
    myvandyke.net
    oa.88tech.me
    oa.myvandyke.net
    order.myvandyke.net
    ybupdate.me

  7. 1 ipv43 yrs ago

    blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage… · virustotal.com/gui/file/ce226bd1f53819d6654caf04a7bb41… · virustotal.com/gui/file/29741e60dca8a68021be35525a6b46… · virustotal.com/gui/file/7201e604359019b484f6a6ac4d8cba… · virustotal.com/gui/file/6e3c3045bb9d0db4817ad0441ee3c9… · virustotal.com/gui/file/3443bb895444c1c7fa0beab54f93a7…

    45.32.33.17:443

  8. 13 domain4 yrs ago

    x.com/TuringAlex/status/1977626210609049683 · trendmicro.com/en_us/research/22/l/probing-weaponized-… · virustotal.com/gui/ip-address/8.219.76.37/relations · virustotal.com/gui/file/db4497090a94d0189aa3c3f4fcee30… · otx.alienvault.com/pulse/6399f1943fb578ccb093a7b7

    amazonawsgarages.com
    analyaze.s3amazonbucket.com
    analysis.windowstearns.com
    cornm100.io
    files.amazonawsgarages.com
    livehelp100services.com
    livehelpl00service.com
    livelyhellp.chat
    max.cornm100.io
    s.livelyhellp.chat
    s3amazonbucket.com
    service.livehelpl00service.com
    services.livehelp100services.com

  9. 1 domain4 yrs ago

    x.com/TuringAlex/status/1977626210609049683 · trendmicro.com/en_us/research/22/l/probing-weaponized-… · virustotal.com/gui/ip-address/8.219.76.37/relations · virustotal.com/gui/file/db4497090a94d0189aa3c3f4fcee30… · otx.alienvault.com/pulse/6399f1943fb578ccb093a7b7

    windowstearns.com

  10. 1 domain, 1 url4 yrs ago

    twitter.com/BushidoToken/status/1577605361930063876 · trendmicro.com/en_us/research/22/h/irontiger-compromis… · trendmicro.com/content/dam/trendmicro/global/en/resear… · virustotal.com/graph/embed/gdc80667c54cc46cba1038b34ef… · virustotal.com/gui/file/07aa739fa4942cfd68d4a075568456…

    domaindataanalyticsclub.com
    urlhttp://104.168.236.46

  11. 8 domain, 5 ipv4, 5 url4 yrs ago

    twitter.com/BushidoToken/status/1577605361930063876 · trendmicro.com/en_us/research/22/h/irontiger-compromis… · trendmicro.com/content/dam/trendmicro/global/en/resear… · virustotal.com/graph/embed/gdc80667c54cc46cba1038b34ef… · virustotal.com/gui/file/07aa739fa4942cfd68d4a075568456…

    domaincenter.veryssl.org
    domainlinux.updatelive-oline.com
    domainntp-server.asia
    domaintime.ntp-server.asia
    domaintime1.ntp-server.asia
    domaintrust.veryssl.org
    domainupdatelive-oline.com
    domainwindows.updatelive-oline.com
    ipv4104.168.211.246:443
    ipv4139.180.216.65:443
    ipv445.142.214.193:443
    ipv445.77.250.141:443
    ipv480.92.206.158:443
    urlhttp://104.168.211.246
    urlhttp://139.180.216.65
    urlhttp://45.142.214.193
    urlhttp://45.77.250.141
    urlhttp://80.92.206.158

  12. 2 domain4 yrs ago

    virustotal.com/gui/file/074edd82af9bbfd98dd0da167f3712…

    i1mc.xyz
    jiqun.i1mc.xyz

  13. 3 ipv44 yrs ago

    twitter.com/autumn_good_35/status/14862965696413409… · verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr…

    103.79.77.200:443
    104.168.236.46:443
    87.98.190.184:443

  14. 3 domain5 yrs ago

    virustotal.com/gui/file/051400edf4aae2a1041743c1b12740… · virustotal.com/gui/file/094f0713e788800496344035e388ef… · virustotal.com/gui/file/6784171c7bfabec50350f3a9042df8… · virustotal.com/gui/file/9dcf1501177b898785315d1f3024cd… · virustotal.com/gui/file/9f7f7b98342621e106def4e55e98fc…

    buy.teamviewsoft.com
    support.teamviewsoft.com
    teamviewsoft.com

  15. 1 domain5 yrs ago

    twitter.com/JAMESWT_MHT/status/1476105632751267840 · docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHD…

    update.fasterwall.com

  16. 1 domain, 5 ipv45 yrs ago

    trendmicro.com/en_us/research/21/d/iron-tiger-apt-upda… · otx.alienvault.com/pulse/607094697706cc521d0f0788

    domainsettings-win.dyndns-office.com
    ipv435.187.148.253:443
    ipv435.220.135.85:443
    ipv447.75.49.32:443
    ipv485.204.74.143:443
    ipv489.35.178.105:443

  17. 6 domain5 yrs ago

    securelist.com/the-leap-of-a-cycldek-related-threat-ac… · otx.alienvault.com/pulse/606dd51193fe95bf9552902e

    cloud.cutepaty.com
    cutepaty.com
    giaitrinuoc.com
    phong.giaitrinuoc.com
    phongay.com
    static.phongay.com

  18. 1 domain6 yrs ago

    virustotal.com/gui/file/99cc8ee3a385c767e25ebaf2dcaefd…

    adobesys.com

  19. 3 domain6 yrs ago

    otx.alienvault.com/pulse/5fd1090b830e4fba81b06cef

    chrome-upgrade.com
    microlynconline.com
    vegispaceshop.org

  20. 5 domain6 yrs ago

    medium.com/@Sebdraven/rtf-royal-road-drops-a-new-b… · otx.alienvault.com/pulse/5f43f48c0712b9c5245d4824 · virustotal.com/gui/ip-address/91.218.113.17/relations

    ckvyk.com
    ckvyk.net
    ggfnv.com
    jgkgv.net
    jkncj.com

  21. 1 url6 yrs ago

    twitter.com/Vishnyak0v/status/1287308019336990720 (… · virustotal.com/gui/file/36fad80a5f328f487b20a3f5fc5f19… · virustotal.com/gui/file/788bd34d3c5d12b9767f8ac5587f19…

    http://139.180.208.225/ajax

  22. 2 domain, 2 ipv46 yrs ago

    twitter.com/pancak3lullz/status/1286021877375303682 · twitter.com/pancak3lullz/status/1286027620740726785 · app.any.run/tasks/949f2624-505c-4f10-a304-1671492f9… · virustotal.com/gui/file/96e38c55174bf287fe0c21a4d8fa63…

    domain265g.site
    domaingj.wxb2568.cn
    ipv427.124.26.136:1943
    ipv427.124.26.136:59486

  23. 62 domain, 1 url6 yrs ago

    twitter.com/_marklech_/status/1268138088167018498 · securelist.com/cycldek-bridging-the-air-gap/97157

    domain24h.tinthethaoi.com
    domaincdn.laokpl.com
    domainchinhsech.com
    domainchototem.com
    domainconglyan.com
    domaincooodkord.com
    domaincophieu.dcsvnqvmn.com
    domaincoreders.com
    domaindaikynguyen21.com
    domaindangquanwatch.com
    domaindcsvnqvmn.com
    domaindiendanlichsu.com
    domaindongaruou.com
    domaindongnain.com
    domaingiaoxuchuson.com
    domainhanghoa.trenduang.com
    domainhcm.vietbaonam.com
    domainhcmuafgh.com
    domainimages.webprogobest.com
    domaininfo.coreders.com
    domainkhinhte.chinhsech.com
    domainkinhte.chototem.com
    domainkinhtevanhoa.com
    domainlaokpl.com
    domainlaomoodwin.com
    domainlaovoanew.com
    domainlat.conglyan.com
    domainlogin.dangquanwatch.com
    domainlogin.diendanlichsu.com
    domainlogin.giaoxuchuson.com
    domainlogin.thanhnienthegioi.com
    domainlogin.vietnamfar.com
    domainluan.conglyan.com
    domainministop14.com
    domainmychau.dongnain.com
    domainnews.cooodkord.com
    domainnews.trungtamwtoa.com
    domainnghiencuu.onetotechnologys.com
    domainnhantai.xmeyeugh.com
    domainonetotechnologys.com
    domainquocphong.ministop14.com
    domainthanhnien.vietnannnet.com
    domainthanhnienthegioi.com
    domainthegioi.kinhtevanhoa.com
    domainthoitiet.yrindovn.com
    domainthoitietdulich.com
    domaintinmoi.thoitietdulich.com
    domaintinmoi.vieclamthemde.com
    domaintinthethaoi.com
    domaintintuc.daikynguyen21.com
    domaintoiyeuvn.dongaruou.com
    domaintrenduang.com
    domaintrungtamwtoa.com
    domainvieclamthemde.com
    domainvietbaonam.com
    domainvietnamfar.com
    domainvietnannnet.com
    domainweb.laomoodwin.com
    domainweb.laovoanew.com
    domainwebprogobest.com
    domainxmeyeugh.com
    domainyrindovn.com
    urlhttp://103.253.25.73

  24. 1 domain6 yrs ago

    marcoramilli.com/2020/03/19/is-apt27-abusing-covid-19-to… · otx.alienvault.com/pulse/5e734d45158714422bc4e774

    motivation.neighboring.site

  25. 4 domain7 yrs ago

    otx.alienvault.com/pulse/5da9dc215c51c8a86a2d19f1

    chatsecure.uk.to
    encryptit.qc.to
    privatehd.us.to
    sex17.us.to

  26. 1 domain7 yrs ago

    twitter.com/MeltX0R/status/1179800013150527488

    tdjsyqty0takah2x.gitoos.com

  27. 2 domain7 yrs ago

    twitter.com/MeltX0R/status/1175309376493629440 · meltx0r.github.io/tech/2019/09/19/emissary-panda-apt.html

    awvsf7esh.dellrescue.com
    yofeopxuuehixwmj.redhatupdater.com

  28. 1 ipv47 yrs ago

    unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-gove…

    185.12.45.134:443

  29. 1 domain7 yrs ago

    medium.com/@Sebdraven/goblin-panda-changes-the-dro…

    tajikstantravel.dynamic-dns.net

  30. 1 domain, 1 ipv4, 2 url7 yrs ago

    blogs.quickheal.com/apt-27-like-newcore-rat-virut-exploitin…

    domainaibeichen.cn
    ipv4115.214.104.26:81
    urlhttp://192.167.4.10
    urlhttp://43.242.75.228

  31. 1 domain7 yrs ago

    medium.com/@Sebdraven/goblin-panda-continues-to-ta… · otx.alienvault.com/pulse/5ccabe9589bea41847a35a0f · twitter.com/_marklech_/status/1268138088167018498 · securelist.com/cycldek-bridging-the-air-gap/97157

    web.hcmuafgh.com

  32. 7 domain7 yrs ago

    twitter.com/JAMESWT_MHT/status/1476105632751267840 · docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHD…

    activity.maacson.com
    bbs.maacson.com
    dns.itbaydns.com
    fasterwall.com
    govmn.tk
    maacson.com
    static.fasterwall.com

  33. 2 domain7 yrs ago

    secureworks.com/research/a-peek-into-bronze-unions-tool… · twitter.com/MeltX0R/status/1175309376493629440 · meltx0r.github.io/tech/2019/09/19/emissary-panda-apt.html

    language.wikaba.com
    solution.instanthq.com

  34. 2 domain7 yrs ago

    secureworks.com/research/a-peek-into-bronze-unions-tool…

    mildupdate.com
    trprivates.com

  35. 3 domain7 yrs ago

    medium.com/@Sebdraven/goblin-panda-changes-the-dro…

    skylineqaz.crabdance.com
    tele.zyns.com
    uzwatersource.dynamic-dns.net

  36. 7 domain8 yrs ago

    labs.bitdefender.com/wp-content/uploads/downloads/operation-…

    centuriosa.info
    dll.pzchao.com
    down.pzchao.com
    rat.pzchao.com
    up.pzchao.com
    zll855.gicp.net
    zll855.no-ip.info

  37. 2 domain8 yrs ago

    otx.alienvault.com/pulse/5da9dc215c51c8a86a2d19f1

    chatsecurelite.uk.to
    chatsecurelite.us.to

  38. 77 domain8 yrs ago

    secureworks.com/cyber-threat-intelligence/threats/threa…

    american.blackcmd.com
    api.apigmail.com
    apigmail.com
    backup.darkhero.org
    bel.updatawindows.com
    binary.update-onlines.org
    blackcmd.com
    castle.blackcmd.com
    ctcb.blackcmd.com
    darkhero.org
    dav.local-test.com
    dev.local-test.com
    ftp.google-ana1ytics.com
    ga.blackcmd.com
    google-ana1ytics.com
    helpdesk.blackcmd.com
    helpdesk.csc-na.com
    helpdesk.hotmail-onlines.com
    helpdesk.lnip.org
    hotmail-onlines.com
    hotmailcontact.net
    jobs.hotmail-onlines.com
    justufogame.com
    laxness-lab.com
    lnip.org
    local-test.com
    login.hansoftupdate.com
    long.update-onlines.org
    longlong.update-onlines.org
    longshadow.dyndns.org
    longshadow.update-onlines.org
    longykcai.update-onlines.org
    lostself.update-onlines.org
    mac.navydocument.com
    mail.csc-na.com
    mantech.updatawindows.com
    micr0soft.org
    microsoft-outlook.org
    mtc.navydocument.com
    mtc.update-onlines.org
    navydocument.com
    news.hotmail-onlines.com
    oac.3322.org
    ocean.apigmail.com
    ocean.local-test.com
    pchomeserver.com
    registre.organiccrap.com
    security.pomsys.org
    services.darkhero.org
    sgl.updatawindows.com
    shadow.update-onlines.org
    sonoco.blackcmd.com
    test.local-test.com
    test.logmastre.com
    up.gtalklite.com
    updatawindows.com
    update-onlines.org
    update.deepsoftupdate.com
    update.hancominc.com
    update.micr0soft.org
    update.pchomeserver.com
    urs.blackcmd.com
    wang.darkhero.org
    webs.local-test.com
    word.apigmail.com
    wordpress.blackcmd.com
    working.blackcmd.com
    working.darkhero.org
    working.hotmail-onlines.com
    www.google-ana1ytics.com
    www.trendmicro-update.org
    www.update-onlines.org
    x.apigmail.com
    ykcai.update-onlines.org
    ykcailostself.dyndns-free.com
    ykcainobody.dyndns.org
    zj.blackcmd.com

  39. 2 url8 yrs ago

    securelist.com/luckymouse-ndisproxy-driver/87914

    http://103.75.190.28
    http://213.109.87.58

  40. 11 domain8 yrs ago

    medium.com/@Sebdraven/malicious-document-targets-v…

    cat.toonganuh.com
    coco.sodexoa.com
    dn.dulichbiendao.org
    dulichculao.com
    gateway.vietbaotinmoi.com
    halong.dulichculao.com
    hn.dulichbiendao.org
    new.sggpnews.com
    toonganuh.com
    web.thoitietvietnam.org
    wouderfulu.impresstravel.ga

  41. 3 domain8 yrs ago

    medium.com/@Sebdraven/gobelin-panda-against-the-be…

    36106g.com
    cv3sa.gicp.net
    sd123.eicp.net

  42. 1 domain8 yrs ago

    medium.com/@Sebdraven/gobelin-panda-against-the-be… · medium.com/@Sebdraven/rtf-royal-road-drops-a-new-b… · otx.alienvault.com/pulse/5f43f48c0712b9c5245d4824 · virustotal.com/gui/ip-address/91.218.113.17/relations

    kmbk8.hicp.net

  43. 4 domain8 yrs ago

    securelist.ru/luckymouse-hits-national-data-center/90…

    bbs.sonypsps.com
    google-updata.tk
    update.iaacstudio.com
    windows-updata.tk

  44. 1 domain8 yrs ago

    securelist.ru/luckymouse-hits-national-data-center/90… · twitter.com/JAMESWT_MHT/status/1476105632751267840 · docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHD…

    wh0am1.itbaydns.com

Further reading 79

39 more, and the report behind every indicator, in G0027.json.