← All Threat Actors
Threat Actor Profile

BRONZE BUTLER

CTG-2006 G0060 REDBALDKNIGHT TEMP.Tick Tick
▲ High Threat
[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
Origin

Known TTPs

Deobfuscate/Decode Files or Information
Data from Local System
System Service Discovery
File Deletion
Python
Spearphishing Attachment
Match Legitimate Resource Name or Location
Screen Capture
Masquerading
Tool
Bypass User Account Control
Visual Basic
Standard Encoding
Software Discovery
Web Protocols
Data from Network Shared Drive
Disable or Modify Tools
System Time Discovery
Drive-by Compromise
DLL
LSASS Memory
Exploitation for Client Execution
Remote System Discovery
Archive via Utility
At
Dead Drop Resolver
Scheduled Task
Taint Shared Content
Malicious File
Binary Padding
Registry Run Keys / Startup Folder
PowerShell
Windows Command Shell
Ingress Tool Transfer
Pass the Ticket
Symmetric Cryptography
Steganography
Domain Account
File and Directory Discovery
Right-to-Left Override

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD