What is APT27?
APT27 is suspected to be a Chinese state-sponsored advanced persistent threat group active since at least 2012, linked to China's Ministry of State Security (MSS, China's primary civilian intelligence agency) and Ministry of Public Security (MPS, China's domestic security and law enforcement ministry). Its primary mission is long-term intelligence collection: gaining persistent access to target networks, moving quietly through systems, and exfiltrating sensitive data over extended periods.
APT27 targets government agencies, defense contractors, aerospace organizations, technology companies, financial services, critical infrastructure, energy, manufacturing, and think tanks across North America, Europe, Asia, and the Middle East. I
The group's cloud evolution is the reason it now matters to any organization running Azure or Microsoft 365. APT27 has added OAuth device code phishing, Active Directory-to-Entra ID pivoting, Microsoft Graph API exfiltration, and IT supply-chain compromise to a toolkit that was previously focused on on-premises intrusions.
The 2026 Cloud Threat Report
See how real-world APT campaigns and cloud threat trends are evolving.
APT27 aliases
APT27 operates under multiple names: Emissary Panda, LuckyMouse, Iron Tiger, Bronze Union, Budworm, and Linen Typhoon. Different security vendors apply these aliases based on their own tracking methodologies, which creates confusion when you are correlating reporting across sources.
APT27's relationship with other Chinese actors
The operational relationship between APT27, HAFNIUM, and Silk Typhoon remains fluid. Following his July 2025 arrest in Italy, the April 2026 extradition of Xu Zewei to the United States referenced HAFNIUM and Silk Typhoon interchangeably in federal court filings. Separately, March 2025 DOJ indictments tied individual contractors across campaigns associated with all three designations.
While MITRE ATT&CK clusters APT27 under Group G0027, commercial vendor mappings diverge: Microsoft tracks APT27 as Linen Typhoon, but designates HAFNIUM and Silk Typhoon as separate threat clusters. The threat intelligence community has not formally resolved whether these represent one unified group, overlapping operations sharing contractors, or a common pool of operators working across multiple tasked campaigns.
Notable APT27 campaigns
Each campaign below added specific capabilities to APT27's current toolkit. Tracing these intrusions sequentially highlights the group's transition from early network espionage to cloud-targeting tradecraft.
Early espionage operations (2013 to 2015)
Between 2013 and 2015, APT27 ran targeted attacks against U.S. defense contractors, government agencies, and aerospace organizations. Primary initial access methods were spearphishing and exploitation of public-facing web servers. The goal was to establish long-term footholds for intelligence collection.
Operation StealthyTrident (2020)
In 2020, APT27 and related group TA428 compromised Able Desktop’s update mechanism, delivering HyperBro, PlugX, and Tmanger to Mongolian government agencies. This supply-chain attack bypassed direct network breaches by using legitimate software updates to gain access to government networks.
Ransomware activity and espionage hybridization (2020 to 2021)
APT27 deployed Polar ransomware alongside HyperBro during targeted intrusions. Initial analysis suggested the deployment might be accidental, while later analysis viewed it as deliberate cover for espionage. Neither explanation is confirmed. Ransomware alongside HyperBro does not rule out espionage as the primary objective.
MiMi chat application supply-chain attack (2022)
In 2022, APT27 (tracked by Trend Micro as Iron Tiger) compromised MiMi chat app distribution servers, delivering HyperBro to Windows users and the rshell backdoor to macOS and Linux users. This expanded its primarily Windows-focused toolkit to macOS, which is often used to access cloud management consoles and developer tools. The attack continued the supply-chain approach used in StealthyTrident.
U.S. Treasury breach and IT supply-chain targeting (2024 to 2025)
In late 2024, attackers used a stolen BeyondTrust Remote Support API key to reach U.S. Treasury Department workstations through the vendor's access rather than Treasury's own perimeter. Public reporting initially linked the intrusion to Silk Typhoon. In January 2025, the Treasury Department's OFAC sanctioned Yin Kecheng in connection with the breach, and a March 2025 DOJ indictment later named Yin as an APT27-affiliated threat actor.
What is APT29?
APT29 is a Russian state-sponsored advanced persistent threat (APT) group attributed to Russia's Foreign Intelligence Service (SVR), conducting cyber espionage operations since at least 2008.
Read more
How APT27 and shared contractor networks operate: Tactics, techniques, and procedures
Here is what threat activity from this cluster looks like so you can recognize it in your environment.
Initial access
APT27 uses targeted spearphishing against diplomatic, military, and government organizations, referencing geopolitical events, real counterparts, and spoofed institutional addresses, as cataloged in the primary MITRE ATT&CK Group G0027 profile. It also exploits unpatched VPN appliances and public-facing web servers with known CVEs, including Microsoft Exchange and Zoho ManageEngine. A 2022 BfV advisory highlighted these flaws alongside fake government login pages and VPN portals used to harvest credentials.
Execution
APT27 uses PlugX and HyperBro for remote access. According to Trend Micro research on their evolved capabilities, their modular loaders can swap payloads in memory without redeploying the full malware stack.
Credential access
To facilitate subsequent lateral movement, operators perform credential dumping early in the intrusion cycle, extracting cleartext passwords and hashes from LSASS memory.
Persistence
APT27 establishes persistence through standard administrative mechanisms like registry run keys and scheduled tasks to survive endpoint reboots or partial remediation. The group also deploys web shells like China Chopper, a shared tool across Chinese APT groups, onto vulnerable web servers to maintain external remote access.
Defense evasion
To hide malicious execution, the group relies extensively on DLL sideloading. By placing a malicious payload next to a legitimate, signed executable (such as CyberArk vfhost.exe or Microsoft rc.exe), they force the trusted binary to load their malware. While DLL sideloading serves as their execution and evasion method, it is triggered via the previously established run keys or scheduled tasks to maintain durability.
Additionally, operators leverage LOLBins (living-off-the-land binaries) such as wmic, certutil, and bitsadmin to pull payloads down natively and hide in normal system noise. The group deliberately avoids noisy lateral movement, moving slowly and selectively to stay below the volume thresholds that trigger security rules. The BfV advisory noted that malware activation is operator-triggered rather than automatic, meaning activity bursts are short and followed by long quiet periods.
Command and control
APT27 routes command and control traffic through distributed compromised proxy servers rather than dedicated infrastructure. The group rotates domains frequently using dynamic DNS and blends C2 traffic with legitimate web activity via HTTPS or custom encrypted protocols.
To hide cloud data exfiltration, the broader contractor ecosystem shared with Silk Typhoon abuses the Microsoft Graph API. As detailed in the Microsoft Threat Intelligence analysis, actors use Graph endpoints to quietly harvest emails and SharePoint documents directly from the cloud tenant, evading perimeter firewalls and legacy network monitoring.
What is APT42? Threat Actor Profile
APT42 is an Iranian state-sponsored cyber espionage group that uses tailored spear phishing and cloud account access for long-term surveillance.
Read moreCloud-specific TTPs of the shared contractor network
Because the contractor pool overlaps across Linen Typhoon (APT27) and Silk Typhoon campaigns, defenders must watch for these shared cloud tradecraft paths:
OAuth application and service principal abuse: Attackers add malicious credentials or secrets to existing, high-privilege OAuth apps. This allows persistent API access without needing passwords or triggering MFA prompts.
AD-to-Entra ID pivoting via Entra Connect: Compromised on-premises accounts enable cloud access through Entra Connect servers. Attackers target synchronization accounts and key stores to jump directly into the cloud tenant. When seamless SSO is enabled, attackers can also forge Kerberos tickets using AZUREADSSOACC.
Microsoft Graph API exfiltration: Attackers query the Microsoft Graph API using hijacked administrative permissions, exfiltrating mailboxes, SharePoint files, and calendars while bypassing traditional perimeter firewalls.
IT supply-chain path: Stolen vendor API keys or service credentials enable downstream cloud access without anomalous authentication, as documented in the Treasury sanctions and BeyondTrust incident.
Because these four attack paths generate telemetry across disparate logs (Entra ID sign-in logs, tenant audit logs, Graph activity logs, and SaaS vendor portals), correlating identity, runtime, and API events is essential to uncover the complete attack path.
Malware and tooling
APT27's toolkit divides into group-specific fingerprints and widely shared tools. The distinction matters for how you escalate.
HyperBro: An in-memory RAT (remote access trojan) that avoids writing to disk in primary deployment mode, making it harder to detect with file-based scanning. This is an APT27-specific fingerprint. Detecting HyperBro warrants immediate escalation to incident response.
SysUpdate: A modular backdoor with confirmed Windows and Linux variants documented in Trend Micro's Linux-targeting report. SysUpdate is an exclusive APT27 lineage tracked under MITRE Software S0663; like HyperBro, its presence warrants immediate escalation to incident response.
PlugX: A RAT shared across multiple Chinese APT groups. Presence alone does not confirm APT27. PlugX warrants investigation and additional context gathering, but not automatic escalation.
ZxShell: A legacy tool with rootkit capabilities tracked by MITRE Software S0412 and Sophos, still deployed but older in the current toolkit than HyperBro or SysUpdate.
Gh0st RAT: Actively deployed despite being over 15 years old as documented in MITRE Software S0032, reflecting APT27's pattern of retaining tools that continue to work.
China Chopper web shell: Widely shared across Chinese APT groups. Treat as a supporting indicator in combination with APT27-specific tools, not as a primary fingerprint on its own.
Watch 5-min demo
See how Wiz Defend detects APT activity across your cloud control plane, workloads, and identities in real time.
What security teams need to overcome APT27
Each control below maps to a technique covered earlier, so you can test coverage against how this group operates. Many of these behaviors show up across other state-backed actors too, so the work pays off beyond one threat profile.
1. Patch internet-facing applications and lock down remote access
According to MITRE ATT&CK, APT27 has repeatedly exploited unpatched internet-facing applications such as Exchange and SharePoint. The group has also used stolen credentials to re-enter through VPN gateways and Outlook on the web (OWA). Start with edge systems listed in CISA's Known Exploited Vulnerabilities catalog, then confirm their management interfaces aren't reachable from the internet. Closing those gaps removes the cheapest way in.
2. Detect DLL sideloading and native tool abuse
Alert when a signed executable loads a DLL from an unusual path, since sideloading hides malicious code behind a trusted binary. Pair that with rules for wmic, certutil, and bitsadmin running from odd parent processes. Examples include certutil decoding a file or bitsadmin pulling content from an external host. Both can be hard to catch with file-based scanning alone, so behavior is where you'll see it.
3. Audit OAuth consent grants and device code sign-ins
Review registered OAuth applications for broad Microsoft Graph scopes such as Mail.Read and Files.ReadWrite, then remove or re-scope any app that lacks a clear business owner. Search the Microsoft Purview Unified Audit Log for consent grants to unfamiliar apps. In Entra ID sign-in logs, flag device code flows, and block them with Conditional Access wherever users don't need them. Microsoft Graph activity logs then show which Graph endpoints a granted app called.
4. Treat Entra Connect as Tier 0 and scope vendor API keys
Isolate Entra Connect servers under the same security boundaries as on-premises domain controllers, as compromised sync accounts bridge on-prem footholds directly into Entra ID. When Microsoft's Seamless Single Sign-On feature is enabled, rotate the Kerberos decryption key for the AZUREADSSOACC computer account at least every 30 days. To mitigate vendor supply-chain pivots like the BeyondTrust incident, restrict third-party service account permissions to least privilege, monitor for off-hours API token usage, and ingest vendor audit logs into your central SIEM.
5. Baseline normal access to spot low-and-slow movement
Low-and-slow lateral movement is designed to stay under volume thresholds, so count-based rules tend to miss it. Baseline normal behavior, then flag sign-ins at odd hours, impossible travel, and connections between hosts that rarely talk. In practice, one signal alone is usually noise, but next to a fresh consent grant or new vendor key login, it's worth chasing. That's why cloud, identity, and supply-chain activity belong in one view.
Correlating identity and runtime signals to detect advanced intrusions with Wiz
Threat actors exploit the visibility gaps between corporate identity systems and cloud infrastructure. A compromised sync account, a suspicious OAuth consent grant, or a living-off-the-land binary execution rarely triggers an alert in isolation.
Wiz Defend bridges these silos by correlating runtime workload events with cloud control plane and identity telemetry inside the Wiz Security Graph. When an actor attempts to pivot into cloud infrastructure, Wiz flags identity anomalies like abnormal OAuth credential additions or unauthorized API usage alongside workload behavior.
On cloud VMs and containers, the lightweight Wiz Runtime Sensor provides real-time visibility and threat detection across hybrid environments. It monitors process execution, memory tampering (such as LSASS dumping on Windows), and network anomalies using eBPF probes on Linux and kernel-level event tracing on Windows. By unifying identity context with runtime telemetry, security teams can pinpoint multi-stage attack paths before lateral movement reaches production assets.
See Wiz in action
Experience unified APT detection across your entire cloud environment—from control plane to workload to identity.
