Threat Group-3390 Targets Organizations for Cyberespionage | Dell SecureWorks

Dell SecureWorks CTU analyzes TG-3390, a China-linked espionage group that uses strategic web compromises and targeted spearphishing to deliver backdoors (HttpBrowser/TokenControl, PlugX), Exchange-targeted web shells (OwaAuth), and credential theft to exfiltrate sensitive defense, industrial, and political information; the report documents TTPs, sample hashes, domains/IPs, timelines of intrusion and exfiltration, and detection/mitigation recommendations.