Iron Tiger

Iron Tiger, also known as Iron Taurus or APT27, is a threat actor group believed to be aligned with China. The group has been involved in numerous cyber-espionage campaigns, targeting various entities including United States defense contractors and other international organizations. Their activities have been tracked back to at least 2015, when they were implicated in Operation Iron Tiger, an extensive espionage campaign that utilized the Gh0st RAT malware variant. The Iron Tiger group has demonstrated a broad range of capabilities and tools throughout its operational history. In 2017, it was observed using the HyperBro malware family. By 2018, the NCC Group reported a variant of Gh0st RAT being used by Iron Tiger. Another notable tool in their arsenal is Win.NOODLERAT, a shellcode-formed in-memory modular backdoor, which has been used for espionage purposes not only by Iron Tiger but also by other unknown clusters and groups like Calypso APT. Iron Tiger's operations have shown significant overlaps with other threat actors and campaigns. For instance, one of the main Diplomatic Specter C2 servers was used in campaigns attributed to Space Pirates in Operation Iron Tiger, tied to Iron Taurus (APT27), and Operation Exorcist, which targeted the Catholic Church and had overlaps with Mustang Panda (Stately Taurus). This group has targeted users across multiple operating systems, including Windows, Linux, and macOS, further demonstrating their broad reach and technical prowess.