APT27
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 6 incidents
- Sources
- 23 sources
- First seen
- 2016-11-22
- Last seen
- 2022-08-09
- Updated
- 2026-10-13 01:36
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
APT27, also known as Bronze Union, TA429 and Emissary Panda, is a China‑linked threat actor described as financially motivated and historically targeting government entities and defense contractors. The group has conducted spear phishing and watering hole attacks to gain employee access, then implanted malware across government websites to enable persistent espionage operations, often routing command‑and‑control traffic through compromised infrastructure such as a Ukrainian Mikrotik router. A notable campaign compromised Mongolia’s national data center between late 2017 and early 2018, providing extensive access to sensitive government systems and data amid heightened China‑Mongolia tensions. Public attribution links APT27 to Beijing‑based actors, with Kaspersky noting its past involvement in government spying and financial crime. No further sectors, regions, tools or motives are specified in the provided material.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 23 sources.