Tick

Tick is a threat actor, also known as BRONZE BUTLER, that likely originates from the People's Republic of China. Secureworks® incident responders and Counter Threat Unit™ (CTU) researchers have been investigating activities associated with this group. Tick has deployed various tools and malware families within compromised networks, specifically those of software companies. Their operations involve the use of Delphi backdoor Command & Control (C&C) servers, such as those hosted on www.averyspace[.]net and www.komdsecko[.]net. The cybersecurity landscape is further complicated by the various uses of the term "tick." For instance, Agent Tesla, a type of malware, calculates the difference between two tick counts to determine if it's being debugged or run in a virtual machine. In another context, social media platforms like X (formerly Twitter) use a gold tick to denote a 'Verified Organization,' while Gmail uses a blue verified tick mark to improve email delivery rates and domain reputation. Safety ratings on platforms like Facebook are also expressed in ticks, with one tick indicating a lower safety rating compared to platforms like Amazon, Lazada, and Qoo10 which have the highest rating of four ticks. Changes in the verification process on social media platforms also impact the cybersecurity landscape. The old “Twitter Blue” program assigned blue ticks to verified accounts for free, but after Elon Musk bought Twitter in October 2022 and renamed it to X, he introduced a new model. Personal accounts can now get a blue tick for an $8 monthly fee, but without identity verification. This lack of verification could potentially allow malicious actors to masquerade as legitimate entities, increasing the risk of cyber threats.