Loading threat actor…
APT27 is a China-linked cyber-espionage threat actor widely known as Emissary Panda and Iron Tiger, and also associated in some reporting with LuckyMouse. The group has been active for more than a decade and is assessed as state-backed or state-aligned, with operations focused on intelligence collection, long-term network access, and theft of sensitive information and intellectual property. APT27 has targeted government organizations, including entities in the Middle East, and has been linked more broadly to campaigns against public-sector and strategic organizations. Reported activity includes exploitation of Microsoft SharePoint vulnerabilities, notably CVE-2019-0604, to deploy web shells and establish persistent access on internet-facing servers. This access can then be used to expand into internal networks and support follow-on espionage operations. The actor’s tradecraft is consistent with mature Chinese intrusion activity: exploitation of public-facing applications for initial access, use of web shells for persistence and post-compromise control, credential theft, stealthy long-term access, and lateral movement within victim environments. APT27 has also been associated with targeting beyond Windows environments, including operations affecting Linux and macOS users in some reporting tied to the LuckyMouse cluster. The group’s behavior aligns with broader Chinese strategic cyber objectives, particularly espionage against government and other high-value institutional targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Although LuckyMouse has been spotted using a widely used Microsoft Office vulnerability (CVE-2017-11882) to weaponize Office documents in the past, researchers have no proofs of this technique being used in this particular attack against the data center.
CVE-2019-0604, a critical vulnerability opening unpatched Microsoft SharePoint servers to attack, is being exploited by attackers to install a web shell... A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package...
22 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linen Typhoon is a Chinese state-backed threat actor known for conducting espionage attacks and intellectual property theft, recently observed exploiting the ToolShell (CVE-2025-53770) vulnerability in Microsoft SharePoint to compromise government, telecom, and academic organizations worldwide.
APT27 is a Chinese cyber-espionage group known for targeting organizations for intelligence gathering.
Lucky Mouse is a China-nexus threat actor known for targeting government and technology sectors, developing cross-platform malware, and leveraging spearphishing and supply chain attacks.
LuckyMouse is a Chinese-speaking APT group targeting government organizations in the Middle East, exploiting SharePoint vulnerabilities and using web shells for further compromise.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.