BRONZE BUTLER

Threat Actor Profile Updated 24 days ago
Download STIX
Preview STIX
Bronze Butler, also known as Tick, is a sophisticated threat actor primarily focusing on cyberespionage against Japanese enterprises. In March 2023, ESET reported an operation by Bronze Butler that compromised the update server of an East Asian Data Loss Prevention (DLP) company, notably serving government and military entities. CTU researchers have linked the activities of Bronze Butler to Bronze Huntley, both reportedly located in the Northern Theater Command. The group employs a range of malware, including Datper — a Delphi-coded RAT likely created by Bronze Butler to replace Daserf. Furthermore, Bronze Butler has demonstrated advanced techniques such as creating forged Kerberos Ticket Granting Tickets (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access. The modus operandi of Bronze Butler involves compromising organizations and creating a list of files from compromised hosts and file-share servers, essentially a "shopping list". In some instances, Bronze Butler has given malware the same name as an existing document file on the file share server, causing users to unwittingly launch and install the malware on additional systems. The group also uses tools like T-SMB Scan to list available SMB hosts and screen-capture tools to gather more information. Bronze Butler's activities often evade detection, with several antivirus tools failing to scan inflated files associated with their incidents. Given the sophistication and persistent nature of Bronze Butler's activities, organizations are advised to actively monitor for signs of this threat actor. Evidence of web server scanning using URL patterns associated with Bronze Butler activity can be found in proxy log files. Additionally, the removal of the help message functionality by Bronze Butler indicates a move towards stealthier operations. As Bronze Butler continues to pose a significant threat to organizations, particularly those in Japan, robust cybersecurity measures and constant vigilance are crucial to mitigate potential attacks.
What's your take? (Question 1 of 1)
c1262e2c-71e0-4456-9e02-713afa8d393e Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Tick
2
Tick is a threat actor group, also known as BRONZE BUTLER, that likely originates from the People's Republic of China. The group has been associated with various malicious activities, including deploying tools and malware families in compromised software company networks. Secureworks® incident respo
REDBALDKNIGHT
2
REDBALDKNIGHT, also known as BRONZE BUTLER or Tick, is an Advanced Persistent Threat (APT) group that has been active since at least 2006. The group primarily targets countries in the Asia Pacific region, with a significant focus on Japanese organizations from as early as 2008. They are known for th
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the BRONZE BUTLER Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
a year ago
The slow Tick‑ing time bomb: Tick APT group compromise of a DLP software developer in East Asia | WeLiveSecurity
MITRE
a year ago
REDBALDKNIGHT’s Daserf Backdoor Now Uses Steganography
MITRE
a year ago
BRONZE BUTLER Hacker Group Targets Japanese Enterprises
CERT-EU
8 months ago
My Tea's not cold : an overview of China's cyber threat – Global Security Mag Online
MITRE
a year ago
Exchange servers under siege from at least 10 APT groups | WeLiveSecurity
CERT-EU
a year ago
ESET: il gruppo di cyberspionaggio Tick colpisce un’azienda di software di data-loss prevention in Asia orientale | Il corriere della sicurezza
Secureworks
a year ago
ShadowPad Malware Analysis
CERT-EU
a year ago
ESET: cyberspionagegroep Tick compromitteert specialist in data protection