BRONZE BUTLER G0060

Overview 23 indicators

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.

Techniques 40 ATT&CK

Open in ATT&CK Navigator → or download the layer (40 techniques, layer 4.5)

• T1003.001 LSASS Memory
• T1005 Data from Local System
• T1007 System Service Discovery
• T1018 Remote System Discovery
• T1027.001 Binary Padding
• T1027.003 Steganography
• T1036 Masquerading
• T1036.002 Right-to-Left Override
• T1036.005 Match Legitimate Resource Name or Location
• T1039 Data from Network Shared Drive
• T1053.002 At
• T1053.005 Scheduled Task
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1059.006 Python
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1080 Taint Shared Content
• T1083 File and Directory Discovery
• T1087.002 Domain Account
• T1102.001 Dead Drop Resolver
• T1105 Ingress Tool Transfer
• T1113 Screen Capture
• T1124 System Time Discovery
• T1132.001 Standard Encoding
• T1140 Deobfuscate/Decode Files or Information
• T1189 Drive-by Compromise
• T1203 Exploitation for Client Execution
• T1204.002 Malicious File
• T1518 Software Discovery
• T1547.001 Registry Run Keys / Startup Folder
• T1548.002 Bypass User Account Control
• T1550.003 Pass the Ticket
• T1560.001 Archive via Utility
• T1566.001 Spearphishing Attachment
• T1573.001 Symmetric Cryptography
• T1574.001 DLL
• T1588.002 Tool
• T1685 Disable or Modify Tools

Software 14

• Mimikatz
• Windows Credential Editor
• gsecdump
• Net
• cmd
• at
• schtasks
• Daserf
• ABK
• BBK
• build_downer
• down_new
• Avenger
• ShadowPad

Principal sources 6 reports

Ranked by how many of this actor's indicators each report brought in.

• 9blogs.jpcert.or.jp/ja/2019/02/tick-activity.html
• 6welivesecurity.com/2023/03/14/slow-ticking-time-bomb-tick-…
• 6image.ahnlab.com/file_upload/asecissue_files/ASEC%20REPO…
• 6otx.alienvault.com/pulse/5d10b9b00e51b1938fd552b5
• 6pastebin.com/91vYTTiZ
• 2blog.talosintelligence.com/2018/10/tracking-tick-through-recent-ca…

Related groups 7

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Leviathan G0065
  shares at, Windows Credential Editor
• Threat Group-3390 G0027
  shares Windows Credential Editor, gsecdump
• Tonto Team G0131
  shares gsecdump, ShadowPad
• APT3 G0022
  shares schtasks
• APT18 G0026
  shares cmd
• menuPass G0045
  shares cmd
• Kimsuky G0094
  shares schtasks

Timeline 23 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2023-03-14 4 domain, 2 url3 yrs ago

   welivesecurity.com/2023/03/14/slow-ticking-time-bomb-tick-…

   domain	mssql.waterglue.org
   domain	oracle.eneygylakes.com
   domain	slientship.com
   domain	travelasist.com
   url	http://103.127.124.117
   url	http://103.127.124.119

   copy batch

2. 2019-06-24 6 domain7 yrs ago

   image.ahnlab.com/file_upload/asecissue_files/ASEC%20REPO… · otx.alienvault.com/pulse/5d10b9b00e51b1938fd552b5 · pastebin.com/91vYTTiZ

   englandprevail.com

   kot.gogoblog.net

   memsbay.com

   poi.cydisk.net

   pre.englandprevail.com

   update.saranmall.com

   copy batch

3. 2019-06-24 4 domain7 yrs ago

   blogs.jpcert.or.jp/ja/2019/02/tick-activity.html

   amamihanahana.com

   han-game.com

   rakutenline.com

   sa-guard.com

   copy batch

4. 2019-02-19 5 domain7 yrs ago

   blogs.jpcert.or.jp/ja/2019/02/tick-activity.html

   menu.han-game.com

   menu.rakutenline.com

   menu.sa-guard.com

   rbb.gol-unkai4.com

   rp.thumbbay.com

   copy batch

5. 2018-10-20 1 url8 yrs ago

   blog.talosintelligence.com/2018/10/tracking-tick-through-recent-ca…

   oonumaboat.com/cx/index.php

   copy batch

6. 2018-10-19 1 url8 yrs ago

   blog.talosintelligence.com/2018/10/tracking-tick-through-recent-ca…

   adc-home.com/28732.html

   copy batch

Further reading 11

• blog.trendmicro.com/trendlabs-security-intelligence/redbald…
• attack.mitre.org/groups/G0060
• documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Mu…
• secureworks.com/research/bronze-butler-targets-japanese…
• symantec.com/connect/blogs/tick-cyberespionage-group…
• image.ahnlab.com/file_upload/asecissue_files/ASEC%20REPO…
• welivesecurity.com/2023/03/14/slow-ticking-time-bomb-tick-…
• blogs.jpcert.or.jp/ja/2019/02/tick-activity.html
• blog.talosintelligence.com/2018/10/tracking-tick-through-recent-ca…
• pastebin.com/91vYTTiZ
• otx.alienvault.com/pulse/5d10b9b00e51b1938fd552b5