G0060 · 41 ATT&CK techniques · 0 correlated reports

BRONZE BUTLER

Aliases: REDBALDKNIGHT, Tick

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.

Open interactive actor investigation

ATT&CK techniques

T1140
Deobfuscate/Decode Files or Information T1005
Data from Local System T1007
System Service Discovery T1070.004
File Deletion T1059.006
Python T1566.001
Spearphishing Attachment T1036.005
Match Legitimate Name or Location T1113
Screen Capture T1036
Masquerading T1588.002
Tool T1548.002
Bypass User Account Control T1059.005
Visual Basic T1132.001
Standard Encoding T1518
Software Discovery T1071.001
Web Protocols T1039
Data from Network Shared Drive T1124
System Time Discovery T1189
Drive-by Compromise T1574.002
DLL Side-Loading T1562.001
Disable or Modify Tools T1003.001
LSASS Memory T1203
Exploitation for Client Execution T1018
Remote System Discovery T1560.001
Archive via Utility T1053.002
At T1102.001
Dead Drop Resolver T1053.005
Scheduled Task T1080
Taint Shared Content T1204.002
Malicious File T1027.001
Binary Padding T1547.001
Registry Run Keys / Startup Folder T1059.001
PowerShell T1059.003
Windows Command Shell T1105
Ingress Tool Transfer T1550.003
Pass the Ticket T1573.001
Symmetric Cryptography T1027.003
Steganography T1087.002
Domain Account T1083
File and Directory Discovery T1036.002
Right-to-Left Override T1059
Command and Scripting Interpreter

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research