BRONZE BUTLER — APT Profile
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.Also tracked as
REDBALDKNIGHT, Tick, TempTick, TEMP.Tick, Stalker Panda
Tools & malware
- ABK Backdoor
- at Execution
- Avenger Backdoor
- BBK Backdoor
- build_downer Backdoor
- cmd Execution
- Daserf backdoor
- Daserf backdoor
- Datper backdoor
- down_new Backdoor
- Gofarer downloader
- gsecdump Credential Harvesting
- gsecdump Credential Harvesting
- HomamDownloader downloader
- Mimikatz credential-theft tool
- Mimikatz credential-theft tool
- Net Network Reconnaissance
- schtasks Persistence
- ShadowPad Backdoor
- SymonLoader loader
- Windows Credential Editor credential-theft tool
- Windows Credential Editor credential-theft tool
- xxmm backdoor
Vendor research
- BRONZE BUTLER Targets Japanese Businesses Secureworks
- Tick Group Weaponized Secure USB Drives to Target Air-Gapped Critical Systems Palo Alto Networks Unit 42
- “Tick” Group Continues Attacks Palo Alto Networks Unit 42
- BRONZE BUTLER Targets Japanese Enterprises Counter Threat Unit Research Team
- REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography Trend Micro
- Tick cyberespionage group zeros in on Japan Symantec
- Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data Trend Micro
- BRONZE BUTLER Targets Japanese Enterprises Secureworks