Loading threat actor…
TAG-67 is an alias used for a Chinese state-sponsored cyber espionage threat actor also tracked as Iron Tiger, LuckyMouse, UNC215, and Budworm. The group is associated with long-running intelligence collection activity and is known for targeting government and other strategic organizations. Reported operations have focused on espionage objectives rather than financially motivated crime. The actor uses a broad post-exploitation toolset that includes ShadowPad, Winnti, PlugX, Cobalt Strike, Brute Ratel, and bespoke backdoors such as Spyder and FunnySwitch. Observed tradecraft includes exploitation of public-facing applications for initial access, use of DLL search order hijacking and DLL sideloading chains to launch payloads, deployment of legitimate signed software as loaders, use of stolen code-signing certificates, and operation of layered command-and-control infrastructure with reverse proxies and long-term access nodes. The group has also used obfuscation and other defense-evasion measures, and has demonstrated sustained post-compromise access and lateral movement capability. Victimology attributed to this cluster includes government entities, particularly in Southeast Asia, as well as academia, aerospace, media, telecommunications, and research organizations. Activity linked to this actor family has been tied to broader Chinese state interests, including intelligence gathering and economic espionage. Public reporting also notes overlap between this cluster and other Chinese espionage designations used by multiple vendors, reflecting the common fragmentation and partial overlap in tracking of PRC-linked intrusion sets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.