APT27: Emissary Panda — China's Strategic Web Compromise Specialists Targeting Defence and Energy

The group that compromises the waterhole.

APT27 — also tracked as Emissary Panda, LuckyMouse, Iron Tiger, Bronze Union, Group 35, ZipToken, TG-3390, Earth Smilodon, and Budworm — is a Chinese state-sponsored threat group that has been conducting cyber espionage operations since at least 2010. APT27 is distinguished by its persistent targeting of defence, aerospace, energy, government, and technology sectors, with a particular emphasis on strategic web compromises (watering hole attacks) as a primary method of initial access. Their campaigns are characterised by methodical, long-duration intrusions designed to harvest sensitive data — intellectual property, government policy documents, military technology, and energy sector intelligence — that directly serves the People's Republic of China's geopolitical and economic interests.

The group's operational tradecraft has evolved significantly over its fifteen-year history. Early campaigns relied heavily on spear-phishing and exploitation of Microsoft SharePoint vulnerabilities to gain footholds in target networks. From approximately 2017 onward, APT27 shifted toward strategic web compromises at scale — identifying and compromising websites frequented by personnel in targeted industries and injecting exploit code that silently delivers malware to visitors matching specific targeting criteria. This evolution reflects a broader trend in Chinese cyber operations: moving away from high-volume, easily attributable phishing campaigns toward more surgical initial access methods that are harder to detect and attribute.

APT27's technical arsenal centres on a suite of custom malware — most notably the HyperBro RAT and the SysUpdate backdoor — supplemented by shared Chinese tooling such as PlugX and the China Chopper web shell. In recent years, the group has demonstrated a significant expansion of capabilities: developing cross-platform Linux variants of their implants, leveraging legitimate cloud services (including Google Drive and Pastebin) for command and control communications, and exploiting high-profile vulnerabilities like ProxyLogon (CVE-2021-26855) to compromise Microsoft Exchange servers at scale. The German Federal Office for the Protection of the Constitution (BfV) publicly attributed APT27 campaigns to the PRC in January 2022, issuing a formal advisory warning German organisations — particularly those in the defence and technology sectors — of the group's active targeting.

Linking APT27 to Chinese state-sponsored operations.

Defence, energy, and strategic infrastructure.

APT27's targeting is tightly aligned with China's strategic intelligence priorities — particularly in defence, aerospace, energy, and government sectors. Unlike more broadly targeted groups, APT27 demonstrates a focused operational mandate, concentrating on industries where stolen data provides direct strategic advantage to the PRC. Geographically, early campaigns concentrated on North America and Western Europe, but from approximately 2015 onward the group expanded significantly into the Middle East, Central Asia, and Southeast Asia — regions where China's Belt and Road Initiative and energy security interests create intelligence requirements. Targeted countries include the United States, United Kingdom, Germany, France, India, Turkey, Israel, Mongolia, and multiple Central Asian republics.

Strategic web compromises at industrial scale.

APT27's defining operational characteristic is its mastery of strategic web compromises — commonly known as watering hole attacks. Rather than sending phishing emails directly to targets (an approach that is increasingly detected and blocked), APT27 identifies websites that are frequently visited by personnel in their target industries and compromises those sites to serve as malware delivery platforms. This technique inverts the attacker-defender dynamic: instead of the threat actor reaching out to the victim, the victim comes to the threat actor. The compromise of a single industry-specific website can provide access to dozens or hundreds of organisations in the target sector, all without sending a single email.

APT27's watering hole operations are characterised by careful reconnaissance and precise targeting. The group typically profiles website visitors using JavaScript code that collects information about the visitor's browser, operating system, IP address, and installed plugins. Only visitors matching specific criteria — such as IP ranges belonging to targeted organisations or browser configurations indicating a corporate environment — are served exploits. This selectivity serves a dual purpose: it maximises the value of the operation by focusing on high-priority targets, and it minimises the risk of detection by ensuring that security researchers and automated scanning tools are less likely to trigger the exploit chain.

The exploit chains deployed through these watering holes have evolved over time. Earlier campaigns exploited Internet Explorer and Java vulnerabilities, while more recent operations have leveraged browser-based exploits targeting Chrome and Firefox, as well as vulnerabilities in commonly deployed enterprise software. Once a visitor is compromised, APT27 typically deploys an initial-stage loader that retrieves the group's primary implant — HyperBro or SysUpdate — from a separate staging server, minimising the amount of malicious code hosted on the compromised website and complicating forensic analysis for incident responders.

Custom implants with shared Chinese heritage.

Multiple vectors — one objective.

From SharePoint to global Exchange exploitation.

APT27's campaign history reveals a group that has steadily expanded its targeting scope and technical sophistication over more than a decade of operations. Early campaigns (2010–2014) were characterised by spear-phishing operations and exploitation of document rendering vulnerabilities, primarily targeting defence contractors and government agencies in the United States and Western Europe. These initial operations, documented by Dell SecureWorks under the designation TG-3390, established the group's core focus areas and demonstrated their ability to maintain persistent access to high-value targets for extended periods — in some cases, years of undetected presence within compromised networks.

The SharePoint exploitation campaigns (2014–2016) marked APT27's emergence as a particularly dangerous threat to enterprise environments. The group identified that many government and defence organisations relied on internet-facing Microsoft SharePoint servers for collaboration and document management, and systematically targeted vulnerabilities in these platforms — including CVE-2019-0604 and earlier SharePoint flaws — to gain initial access. Once inside, APT27 deployed PlugX and HyperBro implants, established persistence through DLL side-loading, and conducted methodical lateral movement to reach high-value data repositories. These campaigns demonstrated APT27's understanding of enterprise IT architecture and their ability to navigate complex corporate networks to reach their intelligence objectives.

From 2017 onward, APT27's strategic web compromise campaigns became the group's defining operational characteristic. Kaspersky documented a series of campaigns under the LuckyMouse designation in which APT27 compromised websites belonging to government agencies and industry organisations in Central Asia and the Middle East, using them as watering holes to deliver HyperBro and PlugX to visitors from targeted organisations. In one notable campaign, the group compromised the website of a national data centre in a Central Asian country, gaining access to a wide range of government systems through a single compromise point. These operations demonstrated APT27's strategic thinking — rather than targeting individual organisations, they targeted shared infrastructure and common resources to achieve broad access efficiently.

The ProxyLogon exploitation campaign (March 2021 onward) represented APT27's most aggressive and wide-ranging operation. Following the disclosure of critical vulnerabilities in Microsoft Exchange Server — collectively known as ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) — APT27 was among the threat groups that rapidly weaponised these flaws. The German BfV specifically attributed exploitation of ProxyLogon to APT27 in their January 2022 advisory, noting that the group targeted German organisations in the defence and technology sectors. APT27 used the Exchange vulnerabilities to deploy China Chopper web shells, which served as initial footholds for loading HyperBro RAT payloads. The scale of Exchange exploitation was unprecedented — thousands of Exchange servers worldwide were compromised by multiple Chinese threat groups in a matter of days, with APT27 focusing on targets aligned with their established intelligence priorities.

The German BfV advisory and attribution (January 2022) was a landmark moment for APT27. The BfV — Germany's domestic intelligence agency — issued a formal cyber threat advisory specifically identifying APT27 as a PRC-sponsored threat group actively targeting German organisations. The advisory detailed APT27's use of HyperBro RAT, described the group's DLL side-loading deployment methodology, and provided specific indicators of compromise to assist German defenders. This represented one of the most explicit European governmental attributions of a Chinese APT group and signalled a shift in how European nations publicly address Chinese cyber espionage — moving from diplomatic discretion to direct, named attribution.

In 2023 and 2024, APT27 continued to evolve with campaigns deploying cross-platform Linux variants of SysUpdate and targeting cloud infrastructure. Trend Micro documented the Earth Smilodon campaigns in which APT27 deployed Linux-compatible backdoors against servers and containerised environments, reflecting the group's adaptation to modern enterprise architectures where critical workloads increasingly run on Linux-based systems. Simultaneously, the group expanded its use of legitimate cloud services — including Google Drive and Dropbox APIs — for command and control communications, making network-level detection significantly more challenging for defenders who cannot easily block traffic to major cloud platforms.

Defending against patient enterprise intruders.

Defending against APT27 requires a layered security approach that accounts for the group's diverse initial access methods, patient post-compromise tradecraft, and increasingly sophisticated evasion techniques. APT27 is a persistent threat — once inside a network, they establish multiple persistence mechanisms and can maintain access for months or years. Their use of legitimate cloud services for C2, DLL side-loading via trusted executables, and cross-platform malware means that no single defensive control is sufficient. Effective defence requires combining proactive vulnerability management, robust endpoint detection, network monitoring, and active threat hunting.

APT27 within China's cyber apparatus.

APT27 operates within China's extensive state-sponsored cyber ecosystem — a network of threat groups affiliated with the People's Liberation Army (PLA), the Ministry of State Security (MSS), and the Ministry of Public Security (MPS). APT27 is assessed to operate under MSS direction, though its precise organisational placement has not been publicly established with the same certainty as groups like APT10 (MSS Tianjin Bureau) or APT41 (Chengdu 404). The group shares tooling — particularly PlugX and, more recently, ShadowPad — with other Chinese APT groups, reflecting the collaborative (or at least shared-resource) nature of the Chinese cyber intelligence apparatus. APT27's focused mandate on defence, energy, and government intelligence collection positions it as a strategic intelligence collection group, distinct from the broader intellectual property theft operations of groups like APT1 or the dual-mandate operations of APT41.

APT27's sustained focus on defence and energy intelligence positions the group as a strategic asset within China's intelligence apparatus. While groups like APT41 attract attention for their dual-mandate operations and supply chain attacks, and Volt Typhoon raises alarm for its infrastructure pre-positioning, APT27 quietly and persistently collects the intelligence that informs Chinese military modernisation, energy security strategy, and foreign policy decisions. The group's shift toward targeting the Middle East and Central Asia — regions critical to China's Belt and Road Initiative — further underscores the alignment between APT27's operations and the PRC's strategic priorities. The German BfV attribution in 2022 marked an important milestone in the public understanding of APT27, but the group's activities span well beyond Germany — they remain an active and significant threat to defence, energy, and government organisations worldwide.

The bottom line.

APT27 is a patient, methodical, and technically capable Chinese state-sponsored threat group that has been conducting cyber espionage operations for over fifteen years. Their signature use of strategic web compromises — watering hole attacks targeting websites frequented by defence, energy, and government personnel — sets them apart from Chinese APT groups that rely primarily on spear-phishing or supply chain attacks. This approach allows APT27 to compromise multiple organisations through a single operation while minimising the detection risks associated with direct targeting. Combined with a capable custom malware arsenal centred on HyperBro RAT and SysUpdate, and supplemented by shared Chinese tooling including PlugX and ShadowPad, APT27 maintains the ability to penetrate and persistently operate within some of the most security-conscious enterprise environments.

The group's evolution over the past decade reflects broader trends in Chinese cyber operations: a shift from volume-based operations to more surgical targeting, the development of cross-platform capabilities to address modern cloud and Linux-based infrastructure, the adoption of legitimate cloud services for command and control to evade network-based detection, and a geographic expansion that now encompasses the Middle East and Central Asia alongside traditional Western targets. The German BfV's formal attribution in 2022 — publicly naming APT27 and linking it to the PRC — demonstrates the increasing willingness of European governments to call out Chinese cyber espionage, but has not visibly deterred the group's operations.

For organisations in APT27's target sectors — defence, aerospace, energy, government, telecommunications, and technology — the group represents a persistent and sophisticated threat that demands sustained defensive investment. APT27 does not conduct smash-and-grab operations; they establish deep, long-term access to compromised networks, patiently collecting intelligence over months or years. Defending against this operational model requires layered security that combines aggressive vulnerability management for internet-facing systems, robust endpoint detection capable of identifying DLL side-loading and in-memory payloads, network monitoring that accounts for cloud-based C2 channels, and proactive threat hunting informed by up-to-date intelligence on APT27's evolving tradecraft. The group's fifteen-year operational history makes clear that they are not going away — and their continued adaptation ensures they will remain a significant threat for years to come.