Bronze Starlight

Bronze Starlight, a Chinese threat actor group, has been linked to various malicious activities in the cybersecurity landscape. The group is known for deploying different types of ransomware payloads, including traditional ransomware schemes such as LockFile and name-and-shame models. Bronze Starlight's operations have targeted organizations in the US and multiple other countries, with indicators suggesting their primary goal appears to be espionage rather than financial gain. They use ransomware as a means of distraction or misattribution, possibly to cover intellectual property theft. The group's recent activities include the use of HUI Loader malware, which was observed in the A41APT campaign linked to another threat actor, Bronze Riverside, and in post-intrusion ransomware activity associated with Bronze Starlight. As of this publication, CTU researchers have not found any public links to the HUI Loader code and noted no further activity from Bronze Starlight following the deployment and execution of HUI Loader to load a Cobalt Strike Beacon. This malware's hosting has sparked intriguing possibilities regarding Bronze Starlight's broader activities. Despite these observations, the connection between Bronze Starlight and certain cyber activities is assessed with low confidence at this time. For instance, there are similarities in file path and naming conventions between the NPS tool variants deployed by RA World and Bronze Starlight. Moreover, some overlapping tactics, techniques, and procedures (TTPs) used by Bronze Starlight were identified in the forensic data related to RA World. However, these connections remain unverified, underlining the need for further research into Bronze Starlight's activities and potential affiliations.