Emperor Dragonfly

Emperor Dragonfly, also known as Bronze Starlight or Storm-0401, is a threat actor group linked to China that has been identified as deploying various ransomware payloads. This group targets sectors such as gambling within Southeast Asia. The cybersecurity industry uses different names for the same threat actor due to lack of standardization, which can sometimes cause confusion when tracking and attributing cyber threats. During our investigation, we found connections in the forensic data within our telemetry that suggest a low-confidence attribution level link between RA World and Bronze Starlight (aka Emperor Dragonfly). This information was gathered from multiple sources, including Malpedia and Sygnia, who have published detailed reports on the activities of this threat actor. These findings highlight the complex web of relationships that often exist within the world of cyber threats. Cybersecurity firm SentinelOne has observed the tactics, techniques, and procedures used by Emperor Dragonfly, asserting their involvement in numerous cyber attacks. The group has been associated with the use of short-lived, sophisticated hacking strategies. As the digital landscape continues to evolve, understanding and mitigating the risks posed by such threat actors is paramount for maintaining robust cybersecurity defenses.