5 malware familiesExploits CVEs in the wild

APT 27

Also known asAPT 27

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics33 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0042

Resource Development

1 technique

T1584

Compromise Infrastructure

TA0001

Initial Access

2 techniques

T1189

Drive-by Compromise

T1566

Phishing

TA0002

Execution

5 techniques

T1047

Windows Management Instrumentation

T1106

Native API

T1203

Exploitation for Client Execution

T1574

Hijack Execution Flow

T1574.001

DLL

T1648

Serverless Execution

TA0003

Persistence

4 techniques

T1112

Modify Registry

T1505

Server Software Component

T1505.003

Web Shell

T1543

Create or Modify System Process

T1543.003

Windows Service

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

TA0004

Privilege Escalation

4 techniques

T1055

Process Injection

T1543

Create or Modify System Process

T1543.003

Windows Service

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

T1548

Abuse Elevation Control Mechanism

T1548.002

Bypass User Account Control

TA0005

Stealth

3 techniques

T1027

Obfuscated Files or Information

T1055

Process Injection

T1574

Hijack Execution Flow

T1574.001

DLL

TA0112

Defense Impairment

1 technique

T1112

Modify Registry

TA0006

Credential Access

1 technique

T1003

OS Credential Dumping

T1003.001

LSASS Memory

TA0007

Discovery

1 technique

T1018

Remote System Discovery

TA0011

Command and Control

1 technique

T1071

Application Layer Protocol

T1071.001×2

Web Protocols

ARSENAL

Associated malware families

5 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

China Chopper"The Canadian Centre for Cyber Security released an alert about ongoing attacks exploiting CVE-2019-0604 to deliver the China Chopper web shell on April 23..."1Mar 18, 2026

ChinaChopper"ChinaChopper, a web shell which allows the attacker to execute commands on the victim’s machine."1Mar 18, 2026

HTTPBrowser"...either the well-known ‘PlugX’ or ‘HttpBrowser’ RAT, a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups."1Mar 18, 2026

Mimikatz"A modified mimikatz which extracts passwords from memory."1Mar 18, 2026

PlugX"Usually, the delivered payload is either the well-known ‘PlugX’ or ‘HttpBrowser’ RAT"1Mar 18, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2017-11882Microsoft Office Equation Editor Remote Code ExecutionIn the wildEvidence1

Although LuckyMouse has been spotted using a widely used Microsoft Office vulnerability (CVE-2017-11882) to weaponize Office documents in the past, researchers have no proofs of this technique being used in this particular attack against the data center.

IOCS

Observables

1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

1 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this threat actor.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping18

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal5

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables1

Domains, IPs, and hashes tied to this actor, refreshed continuously.