Skip to content
brandefense.io
Request A Demo
UnclassifiedIdeologyAdvanced sophistication

REF3927

REF3927 is a threat actor group with an ideological motive, tracked by Brandefense. It uses 16 MITRE ATT&CK techniques.

Also known as
  • RudePanda
Request IOC feedRequest ATT&CK export
Techniques
16
Exploited CVEs
No CVE data
Record updated

About REF3927.

A sophisticated Chinese-speaking threat actor conducting post-exploitation campaigns, known for exploiting misconfigured ASP.NET machine keys on IIS servers and deploying custom malware and legitimate tools. The group employs a geofencing tactic, avoiding targets within mainland China.

Last updated Jul 25, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.