APT27 Threat Actor Profile Guide: Watering holes, server exploits and credential theft explained

APT27, tracked by MITRE as Threat Group-3390, is a long-running Chinese espionage group that gets in through watering holes, exploited Exchange and SharePoint servers and compromised suppliers, then dumps credentials and stays for months with tools such as HyperBro and SysUpdate. Researchers have tracked it since at least 2010, and Microsoft named it among the actors exploiting on-premises SharePoint in July 2025. This profile covers its many names, its targeting, the techniques MITRE ATT&CK records for it, how it abuses identities and credentials, notable reported campaigns, and the controls that blunt it. It is written for security teams in government, defence, aerospace, technology, energy, manufacturing and gambling, and for anyone running internet-facing Microsoft servers. Attribution statements are those of the named government and vendor sources, and the page describes behaviour for defenders only.

Key takeaways

• Server exploitation is the habit. ATT&CK records SharePoint CVE-2019-0604 and the 2021 Exchange ProxyLogon flaws; Germany's BfV reported Exchange and Zoho ADSelfService Plus exploitation from March 2021; Microsoft named the group (as Linen Typhoon) in the July 2025 SharePoint exploitation.
• Watering holes at national scale. Kaspersky reported in 2018 that the group, as LuckyMouse, used access to a Central Asian national data centre to inject scripts into government websites.
• Credential theft is constant. ATT&CK lists LSASS, SAM and LSA secrets dumping, a credential logger on Exchange servers, and theft of a KeePass database.
• Suppliers are a route in. ATT&CK records compromise of third-party service providers and of the Able Desktop chat installer.
• Patch fast, then assume keys are stolen: after server compromise, rotate machine keys, service account passwords and certificates, not just the vulnerable code.

Who they are (names and aliases)

MITRE ATT&CK (G0027) describes Threat Group-3390 as a Chinese group that has extensively used strategic web compromises, active since at least 2010, targeting aerospace, government, defence, technology, energy, manufacturing and gambling or betting organisations. Germany's Federal Office for the Protection of the Constitution (BfV) also says APT27 has been active since at least 2010.

Watch for name collisions. The DOJ's 5 March 2025 announcement of charges against Chinese contract hackers lists the names private researchers use for APT27 as including UTA0178, UNC5221 and Silk Typhoon. Microsoft uses Silk Typhoon for a different group it formerly called HAFNIUM, and lists Linen Typhoon, not Silk Typhoon, for APT27. Treat the DOJ alias list as that agency's mapping and match on indicators. See the Silk Typhoon Threat Actor Profile Guide, the Threat Actor Groups Guide and the China State Cyber Operations Guide.

Targeting and motivation

• Government and defence: ATT&CK lists government, defence and aerospace. Microsoft adds strategic planning and human rights organisations for Linen Typhoon.
• Industry and intellectual property: BfV warned in January 2022 of an ongoing campaign against German companies aimed at trade secrets and intellectual property, and said the attackers might also try to reach customers' or service providers' networks.
• Gambling, banking, telecoms and energy: Trend Micro's April 2021 report describes targeting of Southeast Asian gambling companies, including one Philippine company targeted for 18 months, and governments, banks, telecoms and energy firms in the Middle East and Southeast Asia.
• Whole-country watering holes: the 2018 Kaspersky case targeted visitors to government websites through a compromised national data centre.

The motive in every source is espionage and intellectual property theft. The DOJ's 2025 announcement places APT27 alongside i-Soon, which it describes as a major part of China's hacker-for-hire ecosystem that sold stolen data to Ministry of State Security and Ministry of Public Security bureaus.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 links Threat Group-3390 to 57 techniques and 24 software entries, including HyperBro, SysUpdate, PlugX, China Chopper, ASPXSpy, Cobalt Strike, Mimikatz and Impacket. The selection below focuses on what defenders can detect. All IDs are listed for G0027 in ATT&CK v20.

Exploited vulnerabilities to check first

See the SharePoint Server Security Guide and the Microsoft Exchange Server Security Guide.

How they abuse identities and credentials

APT27 intrusions convert a server foothold into a long-term identity foothold. Each step below is recorded by ATT&CK or the cited vendors.

1. Capture logins at the source: a credential logger installed on Exchange servers records every password users send to the server. Rebuilding mailboxes does not help if the server keeps logging.
2. Dump everything stored: LSASS, SAM and LSA secrets on servers and domain controllers yield user, service account and machine credentials. LSA secrets often hold service account passwords in recoverable form. See the Credential Dumping Guide.
3. Raid password vaults: ATT&CK records theft of a KeePass database. An administrator's vault on a compromised workstation can hold the keys to the whole estate. See the Password Manager Vault Breach Response Playbook.
4. Return through the front door: stolen credentials and harvested VPN profiles let the group reconnect as a legitimate remote user after malware is cleaned up.
5. Steal server secrets: in the 2025 SharePoint exploitation, web shells extracted ASP.NET machine keys, which let attackers forge trusted data and regain code execution after patching. See the ToolShell SharePoint exploitation breach analysis, where Microsoft named Linen Typhoon among three China-based actors.
6. Borrow signing identities: ATT&CK records stolen valid code signing certificates, and Trend Micro reported a rootkit signed with a certificate that the issuing company later confirmed was voided. See the Compromised Code Signing Certificate Playbook.

Notable incidents

Detection and defence

Controls mapped to behaviours

Phased rollout

1. Week 1: check internet-facing Exchange, SharePoint and ADSelfService Plus against the CVE table. Hunt for web shells, new IIS modules and credential loggers before patching, and preserve evidence.
2. Week 2: patch, then rotate ASP.NET machine keys (Set-SPMachineKey or the Machine Key Rotation timer job) and run iisreset on every SharePoint server, as Microsoft advises.
3. Weeks 3 to 6: enable SharePoint AMSI in Full Mode on a test farm, then production; if it cannot be enabled, put the server behind an authenticated gateway or take it off the internet until patched.
4. Month 2: enable LSA protection and Credential Guard on servers in rings, rotate service account passwords stored as LSA secrets, and move administrators' vaults off general-purpose workstations.
5. Ongoing: load the BfV YARA rules and vendor indicators into scanning, require MFA for all VPN access, and review supplier connections quarterly.

What to monitor

• IIS worker process children: w3wp.exe spawning cmd.exe, PowerShell or certutil.
• New files in web roots such as .aspx pages in SharePoint layouts folders.
• Logging changes: appcmd.exe modifying IIS logging, and gaps in forwarded logs.
• DLL side-loading: signed executables running from unusual paths and loading unsigned DLLs.
• VPN sign-ins from accounts that rarely use remote access, especially service accounts.
• Large encrypted RAR archives on web servers and uploads to Dropbox from servers.

Metrics

• Median days to patch KEV-listed vulnerabilities on Exchange, SharePoint and identity portals.
• Percentage of SharePoint servers with AMSI in Full Mode.
• Days since last ASP.NET machine key rotation per farm.
• Percentage of servers with LSA protection and Credential Guard enabled.
• Percentage of VPN accounts with phishing-resistant MFA.

Small organisations should move mail and collaboration to supported cloud services where they cannot patch on-premises servers within days. Large organisations with on-premises farms need a rehearsed Emergency Out-of-Band Patching Playbook and a Web Shell Response Playbook.

Common failure patterns

• Patching without rotating secrets: stolen machine keys and service account passwords outlive the patch.
• Cleaning the web shell but not the logger: a credential logger on Exchange keeps harvesting after the obvious implant is removed.
• Trusting signed binaries: the group side-loads through legitimate signed programs and has used stolen certificates.
• Leaving VPN on passwords alone: harvested credentials and VPN profiles let the group return after eviction.
• Keeping logs only on the server: the group has disabled logging, so local logs may be missing exactly when needed.
• Reading reports by name only: the same activity appears as APT27, Emissary Panda, LuckyMouse, Iron Tiger and Linen Typhoon.

Practitioner checklist

• Check Exchange, SharePoint and ADSelfService Plus servers against the listed CVEs and the KEV catalogue.
• Hunt for web shells, IIS modules and credential loggers before and after patching.
• Rotate ASP.NET machine keys and restart IIS after SharePoint patching.
• Enable SharePoint AMSI Full Mode, LSA protection and Credential Guard.
• Rotate service account passwords stored as LSA secrets after any server compromise.
• Require phishing-resistant MFA for VPN and remote access.
• Forward IIS and Windows logs off-host and alert on logging changes.
• Review supplier remote access and verify installer integrity.
• Map all APT27 aliases in your threat intelligence platform.

Standards and references

• MITRE ATT&CK: Threat Group-3390 (G0027)
• BfV: Cyber-Brief on APT27 HyperBro campaign against German companies
• Microsoft Security: Disrupting active exploitation of on-premises SharePoint vulnerabilities
• US Department of Justice: Charges against 12 Chinese contract hackers and law enforcement officers
• Kaspersky Securelist: LuckyMouse hits national data center
• Trend Micro: Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Threat Actor Groups Guide · China State Cyber Operations Guide · Watering Hole Attacks Guide · SharePoint Server Security Guide · Credential Dumping Guide