Tick

Tick, also known as BRONZE BUTLER, is a threat actor group likely originating from the People's Republic of China. This group has been associated with deploying various tools and malware families in compromised networks, notably within software companies. The group uses sophisticated methods such as KEYPLUG, which selects an IP address within a CIDR block based on the infected computer's tick count. Additionally, Tick controls Delphi backdoor Command and Control (C&C) servers hosted on domains like www.averyspace[.]net and www.komdsecko[.]net, further illustrating their advanced cyber capabilities. The investigation of Tick's activities was carried out by Secureworks® incident responders and Counter Threat Unit™ (CTU) researchers. Notably, Tick's operations have implications for various sectors, including social media platforms. For instance, Vortax, an enterprise-focused video chat service provider, is identified as having a gold tick, indicating it is a 'Verified Organization' on X (formerly Twitter). However, this verification does not necessarily protect against Tick's activities, as demonstrated by Facebook's low safety rating of one tick compared to other platforms like Amazon, Lazada, and Qoo10, which have the highest rating of four ticks. Regulatory compliance and proactive cybersecurity measures are essential in combating threat actors like Tick. As Thompson concluded, organizations must move beyond treating regulation as a tick-box exercise and view it as a starting point for their cyber defenses. This approach is crucial given the increasing sophistication of threat actors and the potential consequences for businesses that fail to adhere to regulations. Despite these challenges, there is room for improvement, such as enhancing email delivery rates and domain reputation, and securing Gmail’s blue verified tick mark with BIMI 3.