BRONZE BUTLER - G0060

Created: 2018-01-16T16:13:52.465Z

Modified: 2021-10-12T19:42:16.869Z

Contributors: Trend Micro Incorporated

Aliases

BRONZE BUTLER,REDBALDKNIGHT,Tick

Description

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

Techniques Used

BRONZE BUTLER has obtained and used open-source tools such as

Mimikatz,

gsecdump, and

Windows Credential Editor.(Citation: Symantec Tick Apr 2016)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|