Iron Tiger

Iron Tiger, also known as Iron Taurus or APT27, is a threat actor group known for executing malicious actions with the intent of espionage. The group became prominent after its involvement in Operation Iron Tiger, which was reported in 2015. This operation was a series of Chinese cyber-espionage attacks targeting U.S. defense contractors. The group used a variant of Gh0st RAT malware, an infamous remote access trojan, during this operation, as evidenced by the string observed in the malware variant. Post the 2015 operations, Iron Tiger continued to evolve and adapt its techniques. From at least 2017, it started using the HyperBro malware family. In 2018, NCC Group reported that Iron Tiger used another variant of Gh0st RAT. Additionally, the group has been associated with the use of Win.NOODLERAT, an in-memory modular backdoor, alongside other threat actors such as Calypso APT in various espionage campaigns. Iron Tiger's activities have not been limited to any specific operating systems, posing threats to Windows, Linux, and macOS users alike. Furthermore, it has connections with other China-aligned actors like Space Pirates in Operation Iron Tiger and overlaps with Mustang Panda (aka Stately Taurus) in Operation Exorcist. The group also reportedly used one of the AspxSpy web shells employed by Gelsemium in Operation Iron Tiger. Overall, Iron Tiger represents a persistent and evolving cyber threat with ties to several significant operations and threat actors.