Threat Group-3390

Signals

NVD · CVE-2026-18907 · Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filenameNVD · CVE-2026-18897 · 8.8 · A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempENVD · CVE-2026-18896 · 6.3 · A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.phNVD · CVE-2026-18895 · 8.8 · A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-18907 · Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filenameNVD · CVE-2026-18897 · 8.8 · A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempENVD · CVE-2026-18896 · 6.3 · A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.phNVD · CVE-2026-18895 · 8.8 · A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07

Threat Actors · Threat Group-3390

· ATT&CK GroupG0027

Earth SmilodonTG-3390Emissary PandaBRONZE UNIONAPT27Iron TigerLuckyMouseLinen Typhoon

Techniques

Software

Tactics

Aliases

Description

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

Tactic Coverage

stealth (9)discovery (7)execution (7)persistence (7)privilege escalation (7)initial access (7)collection (6)resource development (6)credential access (5)lateral movement (2)exfiltration (2)command and control (2)defense impairment (2)

Techniques Used (57)

T1003.001LSASS Memory

credential access

T1003.002Security Account Manager

credential access

T1003.004LSA Secrets

credential access

T1005Data from Local System

collection

T1012Query Registry

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 57 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (24)

S0073ASPXSpymalware S0020China Choppermalware S0660Clamblingmalware S0154Cobalt Strikemalware S0070HTTPBrowsermalware S0398HyperBromalware S0357Impackettool S0002Mimikatz

References (20)

https://attack.mitre.org/groups/G0027 https://www.secureworks.com/research/bronze-union https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/https://thehackernews.com/2018/06/chinese-watering-hole-attack.html https://securelist.com/luckymouse-hits-national-data-center/86083/https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/