Who Is APT27? Targets, Tools, and 2025 Indictments

APT27 is a Chinese state-sponsored cyber espionage group that has been breaking into government agencies, defense contractors, and technology firms since at least 2010 to steal intellectual property and intelligence useful to China. Security researchers also track the group as Emissary Panda, LuckyMouse, Iron Tiger, and (in Microsoft’s naming system) Linen Typhoon. In March 2025, the U.S. Department of Justice unsealed the first criminal charges tied directly to the group, naming two operators and offering million-dollar bounties for information leading to their arrests.¹

Why the Group Has So Many Names

“APT” stands for Advanced Persistent Threat, shorthand for an attacker with the funding, skill, and patience to stay hidden inside a target network for months or years. Different cybersecurity firms independently discover and name the same groups, which is why APT27 also appears in reporting as Emissary Panda, BRONZE UNION, Iron Tiger, LuckyMouse, Earth Smilodon, and Linen Typhoon. MITRE ATT&CK, the standard reference database for threat actors, catalogs it as Threat Group-3390.²

The cybersecurity community treats APT27 as a Chinese state-sponsored operation tied to either the People’s Liberation Army or the Ministry of State Security. The March 2025 DOJ indictment reinforced that view, describing the charged operators as working on behalf of China’s intelligence services and running “for-profit computer intrusion” campaigns dating back to at least 2013.¹

Who APT27 Targets

The goal is espionage, not financial theft. The group goes after trade secrets, proprietary technology, and political intelligence that benefits China strategically. MITRE records target sectors including aerospace, government, defense, technology, energy, manufacturing, and gambling.²

The 2025 indictment put specific names to those categories. Victims included the Defense Intelligence Agency, the Department of Commerce, foreign ministries in Taiwan, India, South Korea, and Indonesia, U.S.-based religious organizations critical of the Chinese government, and Chinese-language media outlets in New York and Hong Kong.¹ Operations span North America, Europe, and East and Southeast Asia. The common thread is information that touches China’s geopolitical priorities, whether that means defense blueprints, diplomatic cables, or intelligence on dissidents abroad.

How They Break In

APT27 gets into networks two main ways. The first is targeted phishing aimed at specific people inside a victim organization. The second, and increasingly preferred, is exploiting vulnerabilities in internet-facing software like Microsoft Exchange, SharePoint, and Zoho ManageEngine. The group moves quickly on newly disclosed flaws, often weaponizing them within days. ProxyLogon in Exchange (CVE-2021-26855 and related bugs) and an authentication bypass in Zoho ManageEngine ADSelfService Plus (CVE-2021-40539) are two well-documented examples. MITRE also notes the use of strategic web compromises, meaning malware planted on sites the targets are likely to visit.²

Signature Tools

Once inside, HyperBro is the group’s signature remote access trojan. It runs entirely in memory, which makes it harder to detect, and gives operators full control of infected machines. APT27 also uses China Chopper (a small web shell), PlugX and gh0st RAT (remote access trojans shared widely among Chinese threat groups), a custom-modified version of Mimikatz called Wrapikatz for dumping Windows credentials, the commercial penetration-testing tool Cobalt Strike, and additional backdoors including SysUpdate, Clambling, and ZxShell.²

Alongside custom malware, the group relies heavily on built-in Windows utilities like PowerShell, the Windows Command Shell, and network discovery tools such as ipconfig and netstat. This “living off the land” approach lets APT27 blend intrusion activity into normal system administration traffic, which makes behavioral detection much harder than signature-based scanning.

Notable Operations

ProxyLogon Exchange Exploitation (2021)

In March 2021, CISA issued an emergency directive after discovering widespread exploitation of four critical Exchange vulnerabilities collectively known as ProxyLogon. The bugs let attackers access Exchange servers remotely and gain persistent control of entire enterprise networks.³ APT27 was among the Chinese-linked groups that exploited the flaws, compromising thousands of organizations worldwide. Germany’s Federal Office for the Protection of the Constitution later warned specifically that APT27 had used ProxyLogon to install HyperBro inside German corporate networks.

Zoho ManageEngine Campaign (2021)

Later in 2021, APT27 exploited an authentication bypass in Zoho ManageEngine ADSelfService Plus, a widely used password management tool. The flaw allowed unauthenticated remote code execution, and the campaign reached organizations in technology, defense, healthcare, energy, and education before CISA issued a public warning in September.

U.S. Treasury Department Breach (2024)

In December 2024, attackers compromised BeyondTrust, a third-party cybersecurity vendor used by Treasury, by exploiting a zero-day to steal a Remote Support SaaS API key. With that key they pivoted into Treasury’s network and reached workstations in the Office of Foreign Assets Control and the Office of Financial Research. Internal reporting indicated the intruders accessed at least 400 computers and took more than 3,000 files, focused on sanctions and law enforcement material. Treasury initially attributed the breach to a group tracked as Silk Typhoon, and the DOJ later identified APT27 operator Yin Kecheng as a key figure behind the intrusion.¹

Supply Chain Attacks and Ivanti Zero-Day (2025)

In early 2025, Microsoft research linked the group to attacks on IT supply chain companies, specifically vendors building remote management tools and cloud applications. Compromising a single vendor gave the group access to that vendor’s customers. The same research tied APT27 to exploitation of an Ivanti zero-day (CVE-2025-0282). The shift matters: rather than attacking each target individually, the group now reaches dozens of downstream victims through one upstream intrusion.

The 2025 DOJ Indictments

On March 5, 2025, the Justice Department unsealed three indictments connected to Chinese state-sponsored hacking. Two of them named APT27 operators Yin Kecheng and Zhou Shuai, also known as “Coldface,” charging them with multi-year, for-profit computer intrusion campaigns. Yin’s charged conduct dates back to at least 2013.¹

A third indictment charged eight employees and two Ministry of Public Security officers connected to i-Soon, a Chinese company that operated as a hacking contractor and allegedly sold access to compromised email accounts to the MSS and MPS for between $10,000 and $75,000 per inbox.¹

The State Department announced a reward of up to $10 million for information identifying anyone conducting malicious cyber activity against U.S. critical infrastructure on behalf of a foreign government, with separate $2 million bounties posted for information leading to the arrests of Yin and Zhou. Treasury also imposed sanctions on Yin for his role in the Treasury breach.¹

APT27 and Silk Typhoon

Attribution is rarely tidy. Microsoft tracks APT27 as Linen Typhoon, which is a separate designation from Silk Typhoon (Microsoft’s name for the group previously called Hafnium).² Some reporting treats APT27 and Silk Typhoon as the same group, and the confusion is understandable: the DOJ identified Yin Kecheng as an APT27 operator while also tying him to the Treasury breach that Microsoft attributed to Silk Typhoon. A reasonable reading is that individual operators work across what Western researchers classify as distinct groups. Chinese state-sponsored hacking does not necessarily organize itself along the boundaries that tracking aliases imply.

Defending Against APT27

The tactics are sophisticated, but most of APT27’s initial access depends on unpatched software and stolen credentials. Both are preventable. CISA’s guidance on defending against Chinese state-sponsored actors emphasizes:⁴

Patch internet-facing systems immediately. APT27’s biggest wins came from known vulnerabilities in Exchange, ManageEngine, and Ivanti products.
Require public-key authentication for administrative accounts where possible, which blunts the value of stolen passwords.
Isolate management interfaces on a dedicated out-of-band network with no route leakage to production systems.
Disable unencrypted management protocols like Telnet and HTTP; use SSH and HTTPS only.
Change all default credentials on network appliances. Defaults remain a routine entry point in real-world breaches.
Audit configurations against an approved baseline. Unexpected changes to firewall rules, access control lists, or AAA server settings can signal compromise.
Monitor for living-off-the-land activity. Because APT27 uses built-in Windows tools, signature-based detection is not enough; behavioral monitoring that flags unusual use of legitimate utilities is essential.

Organizations that handle defense technology, government data, or sensitive research should assume they are potential targets. The group’s move toward supply chain attacks means that even companies outside APT27’s traditional target profile can be swept in if they provide IT services to organizations that fit it.

1
U.S. Department of Justice. Justice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion Campaigns
2
MITRE ATT&CK. Threat Group-3390
3
Cybersecurity and Infrastructure Security Agency. ED 21-02 Mitigate Microsoft Exchange On-Premises Product Vulnerabilities
4
Cybersecurity and Infrastructure Security Agency. Countering Chinese State-Sponsored Actors Compromise of Network Infrastructure