APT27

Profile narrative

Emissary Panda is a Chinese-linked threat actor also tracked under the aliases APT27, LuckyMouse and Iron Tiger. The group is publicly associated with Beijing and is described as a sophisticated Chinese-linked entity in multiple sources. Its activity is attributed to a state nexus with the People’s Republic of China based on the consistent linkage to Chinese infrastructure and targeting patterns.

The actor’s typical targets include government institutions, defense contractors and international aviation bodies. It has been observed breaking into a national data center in Mongolia, compromising the International Civil Aviation Organization’s networks and aiming at U.S. defense sector organizations. Public reporting ties the group to both government spying and financial crime, indicating a dual focus on intelligence gathering and monetary gain.

Observed tactics involve watering‑hole style attacks combined with spear‑phishing emails to gain initial access to victim networks. These methods allow the group to plant malware and maintain persistence while avoiding detection efforts to date no specific malware families are explicitly named for Emissary Panda in the supplied material. The reliance on social engineering and compromised websites reflects a preference for stealthy entry points that facilitate prolonged presence.

Notable operations include the 2017‑2018 intrusion into Mongolia’s national data center, the 2016 breach of the ICAO email system attributed to a likely Emissary Panda member, and repeated attempts against U.S. defense contractors cited in threat intelligence summaries. Each campaign demonstrates the actor’s ability to adapt its targeting to strategic interests while maintaining a consistent Chinese origin. The group’s activities continue to be monitored as part of broader Chinese state‑sponsored cyber threat landscapes.

Incidents

Attributed incidents are available to members.