Loading threat actor…
APT27 is a China-linked advanced persistent threat group associated with cyberespionage operations. It is also tracked as Threat Group-3390, TG-3390, Emissary Panda, Bronze Union, LuckyMouse, Iron Tiger, and Linen Typhoon. Its operations have targeted organizations across Asia, Europe, North America, and other regions, combining credential theft, exploitation, web shells, and persistent remote access. The group deploys web shells on Internet Information Services and Microsoft Exchange servers, including ASPXTool and OwaAuth. OwaAuth operates as an Exchange ISAPI filter. Backdoors associated with APT27 include SysUpdate and HyperBro. The group establishes persistence through Windows startup Registry entries and newly created services. It also retrieves VPN profiles and abuses external VPN access, and has reused stolen Outlook Web Access credentials in attempts to regain access after eviction. APT27 was identified exploiting on-premises Microsoft SharePoint zero-day vulnerabilities during the 2025 ToolShell attacks. APT27 obtains credentials using tools including Mimikatz, its modified variant Wrapikatz, pwdump, gsecdump, and Windows Credential Editor, including credential dumping from domain controllers. It uses legitimate credentials and exploitation of SMB vulnerabilities addressed by MS17-010 for lateral movement, and has exploited CVE-2014-6324 for privilege escalation. Discovery and post-exploitation activities include network enumeration, NBTscan, Impacket, and command-shell execution. Its malware uses XOR encoding, the Metasploit shikata_ga_nai encoder, and LZNT1 compression to conceal executable code and impede analysis.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
52 malware families attributed to this actor across reporting.
47 additional families tracked in Mallory.
23 CVEs this actor has used in observed campaigns. 23 of them exploited in the wild.
Warlock exploits Microsoft SharePoint vulnerabilities as a way to gain initial access to its targets. Its earliest attacks utilized the exploit chain known as "ToolShell."
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
18 more CVEs tied to this actor tracked in Mallory.
509 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Chinese state-sponsored group mentioned as having exploited ToolShell zero-days before public disclosure; it is background context rather than the focus of this report.
Established China-linked state-espionage group mentioned as historical context for Warlock's emergence. It was among the actors exploiting on-premises SharePoint zero-days through the ToolShell chain in July 2025.
Listed in the detection's technique annotations; the content does not attribute ShieldCrash exploitation to this group.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.