BRONZE UNION

Bronze Union, also known as APT27, Emissary Panda, Lucky Mouse, Iron Tiger, and Red Phoenix, is a threat actor with alleged connections to the Chinese government. The group has been observed targeting organizations across Europe, North and South America, Africa, the Middle East, and the Asia-Pacific region. Their activities have shown intersections with several other threat groups such as Winnti (APT41), TA428, RedFoxtrot, Mustang Panda, and Night Dragon. Specific code features attributed to Bronze Union were found in the HyperBro backdoor, and the Zupdax malware has been linked to both Bronze Union and TA428. In September 2023, new attacks were reported involving an updated SysUpdate toolkit deployed by Bronze Union against an Asian government and a Middle East-based telecommunications provider. This was not their first instance of targeting specific industries; a year earlier, in September 2022, they compromised Cobra DocGuard update files to target a Hong Kong-based gambling company. These actions demonstrate the group's broad range of targets and their persistent malicious activity. Bronze Union's tactics bear similarities to multiple Chinese nation-state groups like APT10 (aka Bronze Riverside, Potassium, or Stone Panda), APT27 (aka Bronze Union, Emissary Panda, or Lucky Mouse), and APT41 (aka Barium, Bronze Atlas, or Wicked Panda). Based on Bronze Union's targeting activity, it is assessed that the group likely focuses on political and defense organization networks. This ongoing threat underscores the need for robust cybersecurity measures and vigilance in monitoring potential threats.