Threat Group-3390
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Threat Group-3390Our name
- LuckyMouseKaspersky
- Linen TyphoonMicrosoft
- APT27MITRE ATT&CK
- Emissary PandaMITRE ATT&CK
- Iron TigerMITRE ATT&CK
- TG-3390MITRE ATT&CK
- BRONZE UNIONSecureworks
- Earth SmilodonTrend Micro
Targets
Sectors: Government, Defence, Energy, Manufacturing, Aerospace
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1003.004LSA Secrets
- T1005Data from Local System
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.006Windows Remote Management
- T1027.002Software Packing
- T1027.013Encrypted/Encoded File
- T1027.015Compression
- T1030Data Transfer Size Limits
- T1033System Owner/User Discovery
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1053.002At
- T1055.012Process Hollowing
- T1056.001Keylogging
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1068Exploitation for Privilege Escalation
- T1070.004File Deletion
- T1070.005Network Share Connection Removal
- T1071.001Web Protocols
- T1074.001Local Data Staging
- T1074.002Remote Data Staging
- T1078Valid Accounts
- T1087.001Local Account
- T1105Ingress Tool Transfer
- T1112Modify Registry
- T1119Automated Collection
- T1133External Remote Services
- T1140Deobfuscate/Decode Files or Information
- T1189Drive-by Compromise
- T1190Exploit Public-Facing Application
- T1195.002Compromise Software Supply Chain
- T1199Trusted Relationship
- T1203Exploitation for Client Execution
- T1204.002Malicious File
Malware and tools used
ASPXSpycertutilChina ChopperClamblingCobalt Strikegh0st RATgsecdumpHTTPBrowserHyperBroImpacketipconfigMimikatzNBTscanNetnetstatPandoraPlugXpwdumpRCSessionSysteminfoSysUpdateTasklistWindows Credential EditorZxShell
Source: MITRE ATT&CKRecent news
No stories yet.