HOMETHREATSAPT27
APT / THREAT GROUP🕵️ ESPIONAGE

APT27

🇨🇳China-attributed
1
campaigns
17
aliases
Last seen:Mar 17, 2026

Intelligence Profile

A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.

Threat Analysis

APT27 is a known-sophistication threat actor attributed to China, engaged in cyber operations with a primary motivation of espionage.

The group's espionage-oriented operations suggest a state-sponsored or state-aligned mandate, typically focused on stealing intellectual property, government secrets, or military intelligence. Targets are usually selected for strategic value rather than financial gain.

Known Campaigns

APT27 — Active Operations March 2026

APT27 is a unknown-motivation threat actor attributed to China. A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors....

ACTIVEMEDIUM2026

External References

→https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf
→https://web.archive.org/web/20140129192702/https://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/
→https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/
→https://www.bitdefender.com/files/News/CaseStudies/study/185/Bitdefender-Business-2017-WhitePaper-PZCHAO-crea2452-en-EN-GenericUse.pdf
→https://www.cfr.org/interactive/cyber-operations/iron-tiger
→https://www.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-hacked-government-data-center/
→https://www.secureworks.com/research/bronze-union
→http://newsroom.trendmicro.com/blog/operation-iron-tiger-attackers-shift-east-asia-united-states
→https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
→https://www.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-europe/

Quick Facts

TypeAPT / Threat Group
Motivation🕵️ espionage
Origin🇨🇳 China
Aliases17
SourceMalpedia

Also Known As

Iron TigerAPT27TEMP.HippoGroup 35BudwormEarth SmilodonBRONZE UNIONLinen TyphoonLucky MouseGreedyTaotieCircle TyphoonZipTokenRed PhoenixEMISSARY PANDAG0027TG-3390Iron Taurus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search APT27