APT27
aka Linen Typhoon, Emissary Panda, LuckyMouse, Iron Tiger, Bronze Union, Threat Group-3390
A Chinese espionage group active since around 2010 that steals government and defense information and intellectual property. In 2025 it was seen joining attacks on a SharePoint weakness.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 3
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed as a Chinese state actor (Linen Typhoon) — Microsoft
- Charged two APT27 members, alleging they sold stolen data to customers tied to the Chinese government — US Department of Justice
Exploited vulnerabilities and targeted products
CVE-2025-53770 CVE-2025-53771 CVE-2025-49704 CVE-2025-49706
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Exploiting on-premises servers
Like exploiting a flaw in the lock on the office's shared filing cabinet (SharePoint) to open the whole thing.
Entry
Booby-trapping websites targets visit
Like poisoning the watering hole that the prey visits every day and waiting.
Inside
Planting small back doors on web servers
Like leaving a tiny copied key in the shop's back-door lock that only the intruder knows about.
Goal
Stealing and selling secrets
Like an industrial spy who passes stolen blueprints to whoever will pay for them.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily