BRONZE PRESIDENT

Threat Actor updated 4 months ago (2024-05-04T16:26:52.240Z)

Download STIX

Preview STIX

Bronze President, a Chinese-state-sponsored APT group also known as Mustang Panda, has been identified as a significant threat actor in data theft campaigns. The group has deployed a variety of remote access tools, including Cobalt Strike and RCSession, to steal data from targeted organizations. Bronze President has demonstrated intent to steal data from NGOs conducting research on issues relevant to the People's Republic of China. Researchers at CTU have observed Bronze President's Nbtscan use and net commands. The group is responsible for deploying PlugX malware via phishing emails disguised as legitimate messages. They also use a modified version of the DLL file (goopdate.dll) to install RCSession. In 2020, Bronze President was found to favor Cobalt Strike and Metasploit tools in their campaigns. The group has also demonstrated an intention to steal data using ORat and RCSession. Overall, Bronze President represents a significant threat to organizations conducting research on issues related to the PRC and should be monitored closely by cybersecurity professionals.

Description last updated: 2023-06-22T16:16:21.821Z

What's your take? (Question 1 of 3)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Mustang Panda	4	Mustang Panda, also known as Bronze President, Nomad Panda, Naikon, Earth Preta, and Stately Taurus, is a Chinese-aligned threat actor that has been associated with widespread attacks against various countries in the Asia-Pacific region. The group's malicious activities were first traced back to Mar
RedDelta	2	RedDelta, also known as Bronze President, is a threat actor that has been conducting cyber-espionage attacks since 2014. It is one of the likely Ministry of State Security (MSS)-linked groups which include APT10, APT17, APT27, APT40, APT41, TAG-22, and RedBravo among others. The organization's activ

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

ID	Type	Votes	Profile Description
PlugX	Unspecified	3	PlugX is a notorious malware known for its harmful capabilities and stealthy operations. Often used by the Winnti group, it has been linked to various cyber-attacks, leveraging DLL side-loading to remain undetected. This technique allows it to infiltrate systems without raising alarms, making it an

Source Document References

Information about the BRONZE PRESIDENT Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	a year ago	Chinese Espionage Malware Targets European Healthcare via USB Drives
DARKReading	a year ago	USB Drives Spread Spyware as China's Mustang Panda APT Goes Global
MITRE	2 years ago	BRONZE PRESIDENT Targets NGOs
MITRE	2 years ago	Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware
CERT-EU	2 years ago	Китайские хакеры Mustang Panda используют свежесозданный бэкдор для продвинутого уклонения от обнаружения
BankInfoSecurity	2 years ago	Chinese APT Group Deploying New Malware Backdoor
CERT-EU	2 years ago	Chinese Hackers Are Using a New Backdoor to Deploy Malware \| IT Security News
CERT-EU	2 years ago	Chinese Hackers Are Using a New Backdoor to Deploy Malware
Securityaffairs	a year ago	China-linked APT Mustang Panda targets TP-Link routers with a custom firmware implant
CERT-EU	a year ago	New Mustang Panda attacks targeting TP-Link routers
CERT-EU	a year ago	SideWinder APT attack infrastructure examined
BankInfoSecurity	a year ago	Cyberattacks on Taiwan Surge Amid Chinese Aggression