BRONZE PRESIDENT

Threat Actor updated 7 months ago (2024-05-04T16:26:52.240Z)
Download STIX
Preview STIX
Bronze President, a Chinese-state-sponsored APT group also known as Mustang Panda, has been identified as a significant threat actor in data theft campaigns. The group has deployed a variety of remote access tools, including Cobalt Strike and RCSession, to steal data from targeted organizations. Bronze President has demonstrated intent to steal data from NGOs conducting research on issues relevant to the People's Republic of China. Researchers at CTU have observed Bronze President's Nbtscan use and net commands. The group is responsible for deploying PlugX malware via phishing emails disguised as legitimate messages. They also use a modified version of the DLL file (goopdate.dll) to install RCSession. In 2020, Bronze President was found to favor Cobalt Strike and Metasploit tools in their campaigns. The group has also demonstrated an intention to steal data using ORat and RCSession. Overall, Bronze President represents a significant threat to organizations conducting research on issues related to the PRC and should be monitored closely by cybersecurity professionals.
Description last updated: 2023-06-22T16:16:21.821Z
What's your take? (Question 1 of 3)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Mustang Panda is a possible alias for BRONZE PRESIDENT. Mustang Panda, a China-aligned Advanced Persistent Threat (APT) group, has been identified as a significant cyber threat actor involved in a series of malicious activities. Notably, Mustang Panda was found to be associated with the BRONZE PRESIDENT phishing lure, which delivered PlugX and used modif
4
RedDelta is a possible alias for BRONZE PRESIDENT. RedDelta, also known as Bronze President, is a threat actor that has been conducting cyber-espionage attacks since 2014. It is one of the likely Ministry of State Security (MSS)-linked groups which include APT10, APT17, APT27, APT40, APT41, TAG-22, and RedBravo among others. The organization's activ
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The PlugX Malware is associated with BRONZE PRESIDENT. PlugX is a Remote Access Trojan (RAT) malware known for its stealthy operations and destructive capabilities. It is often used by threat actors to exploit and damage computer systems, steal personal information, disrupt operations, or hold data hostage for ransom. Its deployment has been linked to sUnspecified
3
Source Document References
Information about the BRONZE PRESIDENT Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
a year ago
DARKReading
a year ago
MITRE
2 years ago
MITRE
2 years ago
CERT-EU
2 years ago
BankInfoSecurity
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
Securityaffairs
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
BankInfoSecurity
2 years ago