Threat feed IOCs (12)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT27. Each row shows why it was linked and where it came from.

Public research & publications (30)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• arstechnica.comhttp://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/
• attack.mitre.orghttps://attack.mitre.org/groups/G0027
• documents.trendmicro.comhttps://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf
• learn.microsoft.comhttps://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming
• research.nccgroup.comhttps://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/
• securelist.comhttps://securelist.com/luckymouse-hits-national-data-center/86083/
• thehackernews.comhttps://thehackernews.com/2018/06/chinese-watering-hole-attack.html
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
• secureworks.comhttps://www.secureworks.com/research/bronze-union
• secureworks.comhttps://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
• trendmicro.comhttps://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html
• i.blackhat.comhttps://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf
• web.archive.orghttps://web.archive.org/web/20140129192702/https://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/
• labs.bitdefender.comhttps://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/
• bitdefender.comhttps://www.bitdefender.com/files/News/CaseStudies/study/185/Bitdefender-Business-2017-WhitePaper-PZCHAO-crea2452-en-EN-GenericUse.pdf
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/iron-tiger
• bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-hacked-government-data-center/
• newsroom.trendmicro.comhttp://newsroom.trendmicro.com/blog/operation-iron-tiger-attackers-shift-east-asia-united-states
• threatconnect.comhttps://www.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-europe/
• nccgroup.trusthttps://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/decoding-network-data-from-a-gh0st-rat-variant/
• securelist.comhttps://securelist.com/luckymouse-ndisproxy-driver/87914/
• paper.seebug.orghttps://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/2015.09.17.Operation_Iron_Tiger/Operation%20Iron%20Tiger%20Appendix.pdf
• arstechnica.comhttps://arstechnica.com/information-technology/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/
• attack.mitre.orghttps://attack.mitre.org/groups/G0027/
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/bronze-union
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/atoms/iron-taurus/
• mandiant.comhttps://www.mandiant.com/resources/insights/apt-groups
• pwc.co.ukhttps://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf
• welivesecurity.comhttps://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/