Introduction
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry. Trend Micro Daserf Nov 2017 Secureworks BRONZE BUTLER Oct 2017 Trend Micro Tick November 2019
Activities and Tactics
Targeted Sectors: Infrastructure, Industrial, Manufacturing, Diplomacy, News - Media, Political party, Engineering, Private sector, Government
Country of Origin: 🇨🇳 China
Incident Type: Espionage
Suspected Victims: Japan, China, South Korea, Russian Federation
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1140 Deobfuscate/Decode Files or Information
- T1005 Data from Local System
- T1007 System Service Discovery
- T1070.004 File Deletion
- T1059.006 Python
- T1566.001 Spearphishing Attachment
- T1036.005 Match Legitimate Resource Name or Location
- T1113 Screen Capture
- T1036 Masquerading
- T1588.002 Tool
- T1548.002 Bypass User Account Control
- T1059.005 Visual Basic
- T1132.001 Standard Encoding
- T1518 Software Discovery
- T1071.001 Web Protocols
- T1039 Data from Network Shared Drive
- T1685 Disable or Modify Tools
- T1124 System Time Discovery
- T1189 Drive-by Compromise
- T1574.001 DLL
- T1003.001 LSASS Memory
- T1203 Exploitation for Client Execution
- T1018 Remote System Discovery
- T1560.001 Archive via Utility
- T1053.002 At
- T1102.001 Dead Drop Resolver
- T1053.005 Scheduled Task
- T1080 Taint Shared Content
- T1204.002 Malicious File
- T1027.001 Binary Padding
- T1547.001 Registry Run Keys / Startup Folder
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1105 Ingress Tool Transfer
- T1550.003 Pass the Ticket
- T1573.001 Symmetric Cryptography
- T1027.003 Steganography
- T1087.002 Domain Account
- T1083 File and Directory Discovery
- T1036.002 Right-to-Left Override
ATT&CK technique IDs (denormalized)
- T1003.001
- T1005
- T1007
- T1018
- T1027.001
- T1027.003
- T1036
- T1036.002
- T1036.005
- T1039
- T1053.002
- T1053.005
- T1059.001
- T1059.003
- T1059.005
- T1059.006
- T1070.004
- T1071.001
- T1080
- T1083
- T1087.002
- T1102.001
- T1105
- T1113
- T1124
- T1132.001
- T1140
- T1189
- T1203
- T1204.002
- T1518
- T1547.001
- T1548.002
- T1550.003
- T1560.001
- T1566.001
- T1573.001
- T1574.001
- T1588.002
- T1685
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- Mimikatz (S0002) — tool
- build_downer (S0471) — malware
- cmd (S0106) — tool
- ABK (S0469) — malware
- at (S0110) — tool
- BBK (S0470) — malware
- schtasks (S0111) — tool
- down_new (S0472) — malware
- Daserf (S0187) — malware
- Net (S0039) — tool
- ShadowPad (S0596) — malware
- Windows Credential Editor (S0005) — tool
- gsecdump (S0008) — tool
- Avenger (S0473) — malware
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [5] Trend Micro Daserf Nov 2017 Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017. [6] Secureworks BRONZE BUTLER Oct 2017 Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018. [7] Trend Micro Tick November 2019 Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020. [8] Symantec Tick Apr 2016 DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.