Tick

Tick, also known as BRONZE BUTLER, is a threat actor believed to originate from the People's Republic of China. This group has been linked to cyber-espionage activities and is known for deploying a variety of tools and malware families in their operations. Secureworks® incident responders and Counter Threat Unit™ (CTU) researchers have investigated several instances where Tick compromised software companies' networks. The group uses sophisticated techniques such as selecting an IP address within a CIDR block based on the infected computer's tick count, a strategy used by the KEYPLUG malware. The group operates Command & Control (C&C) servers via websites like www.averyspace[.]net and www.komdsecko[.]net, using them to control the Delphi backdoor they install on compromised systems. The decision to activate the backdoor is made based on various system information such as CPUID, whether it's running on a Virtual Machine, OS version, number of processors, tick count, and other factors. Another tool in their arsenal, Agent Tesla, calculates the difference between two tick counts before and after sleeping for ten milliseconds to detect whether it is being debugged or running in a virtual machine. It's worth noting that the term "tick" is also used in different contexts unrelated to the threat actor. For instance, Vortax, an enterprise-focused alternative to video chat services, has a gold tick on X (formerly Twitter), indicating it's a 'Verified Organization.' Similarly, Facebook has a safety rating of one tick, compared with platforms like Amazon, Lazada, and Qoo10 which have the highest rating of four ticks. Lastly, the term is also used in relation to email delivery rates and domain reputation improvement, as well as in the context of tick-borne encephalitis cases.