Threat Group-3390

G00271 reports

aliases · Threat Group-3390 · Earth Smilodon · TG-3390 · Emissary Panda · BRONZE UNION · APT27 · Iron Tiger · LuckyMouse · Linen Typhoon

Reports

Techniques

Tactics

Countries

33%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1583 (Acquire Infrastructure), T1592 (Gather Victim Host Information), T1588.007 (Artificial Intelligence).
Primary targeting: CN, KR, KP, RU.
Currently dormant: 0 report(s) in last 30d vs 0 prior (+0%).
Hunt coverage 33% of 42 observed techniques (28 gap(s)).
Assessment confidence: medium (60).

Activity & trend

DormantLast 30d: 0 vs 0 prior (+0%)· first reported 2026-05-11 · last 2026-05-11

30d

90d

All

0.0

Rpts/wk

Reporting timeline · 12 months

Movement — last 30 days

Dropped (90d+)

T1583T1592T1588.007T1590.005T1587.001T1592.001T1588.006T1195T1684T1036T1027.016T1591.002

Overview

Analyst triage

Intelligence summary

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1583 · Acquire Infrastructureconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1592 · Gather Victim Host Informationconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1588.007 · Artificial Intelligenceconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1590.005 · IP Addressesconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1587.001 · Malwareconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1592.001 · Hardwareconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1588.006 · Vulnerabilitiesconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1195 · Supply Chain Compromiseconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1684 · Social Engineeringconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1036 · Masqueradingconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1027.016 · Junk Code Insertionconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl
T1591.002 · Business Relationshipsconf 601
evidence: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Expl

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected