Threat Group-3390

Introduction

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. Dell TG-3390 The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors. SecureWorks BRONZE UNION June 2017 Securelist LuckyMouse June 2018 Trend Micro DRBControl February 2020

Activities and Tactics

Targeted Sectors: Technology, Government, Administration, Defense, Government, Private sector

Country of Origin: 🇨🇳 China

First Seen: 2015

Last Activity: 2018

Incident Type: Espionage

Suspected Victims: United States, United Kingdom, France, Japan, Taiwan, India, Canada, China, Thailand, Israel…

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1068 Exploitation for Privilege Escalation
• T1030 Data Transfer Size Limits
• T1190 Exploit Public-Facing Application
• T1046 Network Service Discovery
• T1053.002 At
• T1055.012 Process Hollowing
• T1074.001 Local Data Staging
• T1203 Exploitation for Client Execution
• T1567.002 Exfiltration to Cloud Storage
• T1003.001 LSASS Memory
• T1059.003 Windows Command Shell
• T1555.005 Password Managers
• T1566.001 Spearphishing Attachment
• T1012 Query Registry
• T1003.004 LSA Secrets
• T1027.015 Compression
• T1204.002 Malicious File
• T1033 System Owner/User Discovery
• T1608.001 Upload Malware
• T1505.003 Web Shell
• T1547.001 Registry Run Keys / Startup Folder
• T1027.013 Encrypted/Encoded File
• T1543.003 Windows Service
• T1199 Trusted Relationship
• T1016 System Network Configuration Discovery
• T1105 Ingress Tool Transfer
• T1056.001 Keylogging
• T1059.001 PowerShell
• T1078 Valid Accounts
• T1608.004 Drive-by Target
• T1588.002 Tool
• T1018 Remote System Discovery
• T1583.001 Domains
• T1189 Drive-by Compromise
• T1140 Deobfuscate/Decode Files or Information
• T1003.002 Security Account Manager
• T1133 External Remote Services
• T1005 Data from Local System
• T1087.001 Local Account
• T1195.002 Compromise Software Supply Chain
• T1548.002 Bypass User Account Control
• T1119 Automated Collection
• T1560.002 Archive via Library
• T1027.002 Software Packing
• T1588.003 Code Signing Certificates
• T1047 Windows Management Instrumentation
• T1071.001 Web Protocols
• T1070.005 Network Share Connection Removal
• T1021.006 Windows Remote Management
• T1574.001 DLL
• T1070.004 File Deletion
• T1685.001 Disable or Modify Windows Event Log
• T1608.002 Upload Tool
• T1112 Modify Registry
• T1210 Exploitation of Remote Services
• T1074.002 Remote Data Staging
• T1049 System Network Connections Discovery

ATT&CK technique IDs (denormalized)

• T1003.001
• T1003.002
• T1003.004
• T1005
• T1012
• T1016
• T1018
• T1021.006
• T1027.002
• T1027.013
• T1027.015
• T1030
• T1033
• T1046
• T1047
• T1049
• T1053.002
• T1055.012
• T1056.001
• T1059.001
• T1059.003
• T1068
• T1070.004
• T1070.005
• T1071.001
• T1074.001
• T1074.002
• T1078
• T1087.001
• T1105
• T1112
• T1119
• T1133
• T1140
• T1189
• T1190
• T1195.002
• T1199
• T1203
• T1204.002
• T1210
• T1505.003
• T1543.003
• T1547.001
• T1548.002
• T1555.005
• T1560.002
• T1566.001
• T1567.002
• T1574.001
• T1583.001
• T1588.002
• T1588.003
• T1608.001
• T1608.002
• T1608.004
• T1685.001

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• SPACESHIP:
• CyberGate:
• Cyber Eye RAT:

MITRE ATT&CK Software

• Net (S0039) — tool
• Systeminfo (S0096) — tool
• gsecdump (S0008) — tool
• PlugX (S0013) — malware
• ASPXSpy (S0073) — malware
• Cobalt Strike (S0154) — malware
• Mimikatz (S0002) — tool
• Impacket (S0357) — tool
• gh0st RAT (S0032) — malware
• certutil (S0160) — tool
• China Chopper (S0020) — malware
• HTTPBrowser (S0070) — malware
• Tasklist (S0057) — tool
• netstat (S0104) — tool
• SysUpdate (S0663) — malware
• HyperBro (S0398) — malware
• ZxShell (S0412) — malware
• RCSession (S0662) — malware
• ipconfig (S0100) — tool
• Clambling (S0660) — malware
• pwdump (S0006) — tool
• NBTscan (S0590) — tool
• Pandora (S0664) — malware
• Windows Credential Editor (S0005) — tool

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [11] SecureWorks BRONZE UNION June 2017 Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017. [12] Dell TG-3390 Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. [13] Unit42 Emissary Panda May 2019 Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. [14] Gallagher 2015 Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”. Retrieved January 25, 2016. [15] Hacker News LuckyMouse June 2018 Khandelwal, S. (2018, June 14). Chinese Hackers Carried Out Country-Level Watering Hole Attack. Retrieved August 18, 2018. [16] Securelist LuckyMouse June 2018 Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018. [17] Trend Micro Iron Tiger April 2021 Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021. [18] Trend Micro DRBControl February 2020 Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021. [19] Microsoft Naming Conventions Frequently Updated Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025. [20] Nccgroup Emissary Panda May 2018 Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.