Bronze University

Bronze University, also known as Aquatic Panda, ControlX, RedHotel, and Earth Lusca, is a threat actor group believed to be a Chinese state-sponsored hacking operation. The group has been active since 2021, targeting government, aerospace, education, telecommunications, media, and research organizations across 17 countries, including the U.S., Taiwan, and India. This information comes from multiple sources, including SC Magazine's Threat Intelligence and Critical Infrastructure Security reports, as well as Recorded Future's news site, The Record. The group uses a variety of sophisticated tools for its operations, most notably the ShadowPad DLL loader (log.dll and iviewers.dll), ShadowPad C2 server, and encrypted payloads (log.dll.dat and iviewers.dll.dat). These tools allow Bronze University to infiltrate systems and networks, execute malicious actions, and maintain control over compromised assets. Notably, Dell SecureWorks has attributed one particular sample, named iviewers.dll.dat, to Bronze University, distinguishing it from other ShadowPad samples typically named log.dll.dat. The threat posed by Bronze University is significant due to its widespread activity, the critical nature of its targets, and its advanced toolset. The group's focus on critical infrastructure sectors and its ability to operate across international borders highlights the need for robust cybersecurity measures and international cooperation in combating such threats. Continued threat intelligence gathering and sharing will be crucial in understanding and mitigating the risks associated with Bronze University and similar threat actor groups.