APT27

Summary

Chinese cyberespionage group tracked by MITRE as Threat Group-3390 (G0027), active since at least 2010, known for strategic web compromises against aerospace, government, defense, technology, energy, manufacturing and gambling targets. Microsoft (as Linen Typhoon) describes a focus since 2012 on stealing intellectual property from government, defense, strategic-planning and human-rights organisations, and in July 2025 observed it exploiting on-premises SharePoint (ToolShell: CVE-2025-49706/-49704). ESET saw LuckyMouse use the Exchange ProxyLogon chain against a Middle East government email server on 2021-03-01, a day before Microsoft's patch, then attempt to install SysUpdate. Trend Micro documented Iron Tiger trojanising MiMi chat installers (2021–2022) to deliver HyperBro and the cross-platform rshell backdoor to targets in Taiwan and the Philippines, and a Linux-capable SysUpdate used against a Philippine gambling company in 2022. In March 2025 the US DOJ indicted two alleged APT27 members, Yin Kecheng and Zhou Shuai, describing for-profit intrusions sold to PRC government customers.

Attribution

Hackers-for-hire selling to PRC security services (DOJ)

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Microsoft Threat Intelligence (Research, 2025-07-22)
  Tracks it as Chinese nation-state actor Linen Typhoon
• US Department of Justice (Government, 2025-03-05)
  Indicted APT27 hackers-for-hire who sold stolen data to MSS and MPS customers
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Chinese threat group

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 12

Malware and tools 9

Exploited vulnerabilities 10

Highest CVSS first.

Infrastructure patterns

• Controlled the vendor servers hosting MiMi chat installers (Trend Micro, 2022)
• Dropbox payloads and tools on compromised sites; watering holes screen visitor IPs (MITRE ATT&CK, 2026)

Reporting and advisories 6

• Microsoft
  Disrupting active exploitation of on-premises SharePoint vulnerabilities (Linen Typhoon)
• Trend Micro
  Iron Tiger's SysUpdate Reappears, Adding Linux Targeting
• Trend Micro
  Iron Tiger Compromises Chat Application Mimi
• ESET
  Exchange servers under siege from at least 10 APT groups
• US DOJ
  Charges against i-Soon and APT27 actors (Mar 2025)
• MITRE ATT&CK
  APT27 (G0027) group profile