Article Content Summary In 2015, the SecureWorks® Counter Threat Unit™ (CTU) research team documented the BRONZE UNION threat group (formerly labeled TG-3390), which CTU™ analysis suggests is based in the People's Republic of China (PRC) Since that analysis, CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group's methods and espionage objectives Despite multiple public disclosures of their activities, BRONZE UNION remains an active and formidable threat as of this publication CTU researchers divided the threat intelligence about this group into two sections: strategic and tactical Executives can use the strategic assessment of the ongoing threat to determine how to reduce risk to their organization's mission and critical assets Computer network defenders can use the tactical information gathered from incident response investigations and research to reduce the time and effort associated with responding to the threat group's activities Key points  CTU researchers assess it is highly likely that the BRONZE UNION threat group gathers defense, security, and political intelligence from organizations around the world CTU researchers have observed it targeting organizations in the aerospace, government, defense, technology, energy, and manufacturing verticals CTU researchers assess it is likely that the group is located in the People's Republic of China BRONZE UNION has historically used strategic web compromises (SWCs) in its campaigns, CTU researchers have also observed it exploiting vulnerable Internet-facing services to gain access to targeted networks After accessing a network, the threat actors leverage a range of proprietary, publicly available, and native tools to search for and acquire desirable data Strategic threat intelligence Analysis of a threat group's targeting, origin, and competencies can determine which organizations could be at risk This information can help organizations make strategic defensive decisions regarding this threat Intent Based on BRONZE UNION's targeting activity, CTU researchers assess it is highly likely that the group focuses on political and defense organization networks In 2016, the threat actors conducted a strategic web compromise (SWC) on the website of an international industry organization that affected aerospace, academic, media, technology, government, and utilities organizations around the world During a discrete period of activity, this SWC was used to specifically target Turkish government, banking, and academic networks These focused attacks suggest a concerted effort to compromise strategically significant networks in Turkey, possibly due to Turkey's political, economic, and military relationships in Europe and the Middle East In addition, BRONZE UNION activity on multiple U.S.-based defense manufacturer networks included the threat actors seeking information associated with aerospace technologies, combat processes, and naval defense systems Third-party analysis suggests that systemic issues in the PRC’s defense technology industries could influence demand for this type of information because this type of data could potentially address innovation and supply deficits which exist within this industry sector in the PRC Attribution In 2015, CTU researchers assessed that BRONZE UNION likely originates in the PRC based on factors such as targeting, operating hours, and tool selection Observed activity since 2015 reinforces that association; for example:  continued focus on information that would be of interest to individuals or groups living in a country that has a significant manufacturing base and a strategic interest in U.S military capabilities use of web shells that have historically been leveraged by threat groups believed to be operating in the PRC connections between a subset of the group's operational infrastructure and PRC-based Internet service companies   Capability BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems CTU researchers identified evidence of the group exploiting vulnerabilities in Internet-facing service desk software to gain an initial foothold on desirable networks, while concurrently compromising systems of interest via SWCs During the observed intrusions, the group rapidly collected account credentials, escalated privileges, and deployed multiple web shells presumably to extend its access across the compromised network BRONZE UNION is disciplined and takes proactive steps to avoid detection The group also manipulated native Windows features on compromised systems to access additional legitimate functionality These behaviors indicate that the threat actors quickly gain a detailed understanding of the environments they compromise and use this understanding to conceal their activity from network defenders Although CTU researchers have observed BRONZE UNION modifying its tools, likely in response to public reporting on its activities, there is no evidence that the group's capabilities have changed substantially or that its operations have been deterred Tactical threat intelligence Investigating BRONZE UNION activity and evicting the threat actors from compromised networks have given CTU researchers unique insight into the group's tools and tactics Captured credentials are DES-encrypted using the password “12345678” (see Figure 1), and are written to a text file (log.txt) in the system's root directory Figure 1 Configuration file from OwaAuth.dll Rcmd — This lateral movement tool facilitates the execution of commands on systems across the target environment Wrapikatz — This tool wraps Mimikatz code in a custom loader to evade antivirus detection, and changes the command-line usage to evade process-telemetry detection and make the tool easier to use This tool is not exclusive to BRONZE UNION CTU researchers have observed various threat groups leveraging Wrapikatz binaries with different usage options Netview — This publicly available host-enumeration tool presents details about IP addresses, network shares, remote sessions, and logged-on users Kekeo — This publicly available toolset manipulates the Kerberos authentication protocol Tactics, techniques, and procedures Observations of BRONZE UNION activity during several network compromises gave CTU researchers insight into the tactics the group employs Access vectors and command and control CTU researchers observed BRONZE UNION delivering malware to systems via SWCs and scan-and-exploit techniques The threat actors appear to be able to create and leverage multiple SWCs in parallel They have also demonstrated the ability to create SWCs and malware-staging sites by leveraging websites linked to networks previously compromised by the group Apparent overlap between existing compromises and new campaigns suggests that the group considers leveraging existing network compromises when planning infrastructure requirements Figure 2 shows a BRONZE UNION infection chain leveraging an SWC Figure 2 Likely BRONZE UNION infection chain observed in 2016 These events strongly suggest that the threat actors leveraged the web application as part of the initial compromise vector The threat actors also integrate infrastructure they likely previously compromised for espionage purposes For example, CTU researchers identified the group using IP addresses owned by several, presumably compromised, research organizations to interact with web shells in other target environments In a separate incident, CTU researchers identified a file named s.txt, which is consistent with the output of the Netview host-enumeration tool Knowledge of the compromised environment allows the threat actors to move laterally between systems CTU researchers identified ten compromised hosts in one environment that contained artifacts associated with the Rcmd lateral-movement tool Use of the tool leaves a small helper script (read.vbs) on the target system Defensive evasion CTU researchers observed BRONZE UNION actors reconfiguring legitimate Windows features to establish PowerShell remoting and WinRM (see Figure 3) These remote management technologies allow a full range of configuration, data transfer, and remote execution capabilities over HTTP/HTTPS channels Enabling these features gives the threat actor a remote control channel to persistently access the victim's environment without using malicious software that could be detected Figure 3 PowerShell commands The DLL acts as a stub loader, which loads and executes shell code BRONZE UNION previously used this technique to enable execution of PlugX and HttpBrowser tools in a way that is challenging for network defenders to detect Figure 4 (Source: SecureWorks) Credential access BRONZE UNION uses various tools for credential theft Figure 5 shows the commands used to perform these activities on a RAR archive renamed with a *.jpg extension Figure 5 BRONZE UNION commands The threat actor also attempted to use OWA account credentials likely acquired during an earlier phase of the intrusion BRONZE UNION appeared to leverage other compromised infrastructure, presumably to make reentry attempts seem legitimate This attempt illustrates the importance of thorough planning when conducting an eviction and the need for continuous vigilance for evidence of reentry Conclusion As of this publication, BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace Its activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems To mitigate these threats, CTU researchers recommend that clients conduct regular internal vulnerability scanning, patching, and upgrading of priority systems, particularly Internet-facing systems and users' devices Early detection and response can minimize exposure and damage Threat indicators The threat indicators in Table 1 are associated with BRONZE UNION activity The IP addresses may contain malicious content, so consider the risks before opening them in a browser BRONZE UNION indicators 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Summary In 2015, the SecureWorks® Counter Threat Unit™ (CTU) research team documented the BRONZE UNION threat group (formerly labeled TG-3390), which CTU™ analysis suggests is based in the People's Republic of China (PRC) Since that analysis, CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group's methods and espionage objectives Despite multiple public disclosures of their activities, BRONZE UNION remains an active and formidable threat as of this publication CTU researchers divided the threat intelligence about this group into two sections: strategic and tactical Executives can use the strategic assessment of the ongoing threat to determine how to reduce risk to their organization's mission and critical assets Computer network defenders can use the tactical information gathered from incident response investigations and research to reduce the time and effort associated with responding to the threat group's activities Key points  CTU researchers assess it is highly likely that the BRONZE UNION threat group gathers defense, security, and political intelligence from organizations around the world CTU researchers have observed it targeting organizations in the aerospace, government, defense, technology, energy, and manufacturing verticals CTU researchers assess it is likely that the group is located in the People's Republic of China BRONZE UNION has historically used strategic web compromises (SWCs) in its campaigns, CTU researchers have also observed it exploiting vulnerable Internet-facing services to gain access to targeted networks After accessing a network, the threat actors leverage a range of proprietary, publicly available, and native tools to search for and acquire desirable data Strategic threat intelligence Analysis of a threat group's targeting, origin, and competencies can determine which organizations could be at risk This information can help organizations make strategic defensive decisions regarding this threat Intent Based on BRONZE UNION's targeting activity, CTU researchers assess it is highly likely that the group focuses on political and defense organization networks In 2016, the threat actors conducted a strategic web compromise (SWC) on the website of an international industry organization that affected aerospace, academic, media, technology, government, and utilities organizations around the world During a discrete period of activity, this SWC was used to specifically target Turkish government, banking, and academic networks These focused attacks suggest a concerted effort to compromise strategically significant networks in Turkey, possibly due to Turkey's political, economic, and military relationships in Europe and the Middle East In addition, BRONZE UNION activity on multiple U.S.-based defense manufacturer networks included the threat actors seeking information associated with aerospace technologies, combat processes, and naval defense systems Third-party analysis suggests that systemic issues in the PRC’s defense technology industries could influence demand for this type of information because this type of data could potentially address innovation and supply deficits which exist within this industry sector in the PRC Attribution In 2015, CTU researchers assessed that BRONZE UNION likely originates in the PRC based on factors such as targeting, operating hours, and tool selection Observed activity since 2015 reinforces that association; for example:  continued focus on information that would be of interest to individuals or groups living in a country that has a significant manufacturing base and a strategic interest in U.S military capabilities use of web shells that have historically been leveraged by threat groups believed to be operating in the PRC connections between a subset of the group's operational infrastructure and PRC-based Internet service companies   Capability BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems CTU researchers identified evidence of the group exploiting vulnerabilities in Internet-facing service desk software to gain an initial foothold on desirable networks, while concurrently compromising systems of interest via SWCs During the observed intrusions, the group rapidly collected account credentials, escalated privileges, and deployed multiple web shells presumably to extend its access across the compromised network BRONZE UNION is disciplined and takes proactive steps to avoid detection The group also manipulated native Windows features on compromised systems to access additional legitimate functionality These behaviors indicate that the threat actors quickly gain a detailed understanding of the environments they compromise and use this understanding to conceal their activity from network defenders Although CTU researchers have observed BRONZE UNION modifying its tools, likely in response to public reporting on its activities, there is no evidence that the group's capabilities have changed substantially or that its operations have been deterred Tactical threat intelligence Investigating BRONZE UNION activity and evicting the threat actors from compromised networks have given CTU researchers unique insight into the group's tools and tactics Captured credentials are DES-encrypted using the password “12345678” (see Figure 1), and are written to a text file (log.txt) in the system's root directory Figure 1 Configuration file from OwaAuth.dll Rcmd — This lateral movement tool facilitates the execution of commands on systems across the target environment Wrapikatz — This tool wraps Mimikatz code in a custom loader to evade antivirus detection, and changes the command-line usage to evade process-telemetry detection and make the tool easier to use This tool is not exclusive to BRONZE UNION CTU researchers have observed various threat groups leveraging Wrapikatz binaries with different usage options Netview — This publicly available host-enumeration tool presents details about IP addresses, network shares, remote sessions, and logged-on users Kekeo — This publicly available toolset manipulates the Kerberos authentication protocol Tactics, techniques, and procedures Observations of BRONZE UNION activity during several network compromises gave CTU researchers insight into the tactics the group employs Access vectors and command and control CTU researchers observed BRONZE UNION delivering malware to systems via SWCs and scan-and-exploit techniques The threat actors appear to be able to create and leverage multiple SWCs in parallel They have also demonstrated the ability to create SWCs and malware-staging sites by leveraging websites linked to networks previously compromised by the group Apparent overlap between existing compromises and new campaigns suggests that the group considers leveraging existing network compromises when planning infrastructure requirements Figure 2 shows a BRONZE UNION infection chain leveraging an SWC Figure 2 Likely BRONZE UNION infection chain observed in 2016 These events strongly suggest that the threat actors leveraged the web application as part of the initial compromise vector The threat actors also integrate infrastructure they likely previously compromised for espionage purposes For example, CTU researchers identified the group using IP addresses owned by several, presumably compromised, research organizations to interact with web shells in other target environments In a separate incident, CTU researchers identified a file named s.txt, which is consistent with the output of the Netview host-enumeration tool Knowledge of the compromised environment allows the threat actors to move laterally between systems CTU researchers identified ten compromised hosts in one environment that contained artifacts associated with the Rcmd lateral-movement tool Use of the tool leaves a small helper script (read.vbs) on the target system Defensive evasion CTU researchers observed BRONZE UNION actors reconfiguring legitimate Windows features to establish PowerShell remoting and WinRM (see Figure 3) These remote management technologies allow a full range of configuration, data transfer, and remote execution capabilities over HTTP/HTTPS channels Enabling these features gives the threat actor a remote control channel to persistently access the victim's environment without using malicious software that could be detected Figure 3 PowerShell commands The DLL acts as a stub loader, which loads and executes shell code BRONZE UNION previously used this technique to enable execution of PlugX and HttpBrowser tools in a way that is challenging for network defenders to detect Figure 4 (Source: SecureWorks) Credential access BRONZE UNION uses various tools for credential theft Figure 5 shows the commands used to perform these activities on a RAR archive renamed with a *.jpg extension Figure 5 BRONZE UNION commands The threat actor also attempted to use OWA account credentials likely acquired during an earlier phase of the intrusion BRONZE UNION appeared to leverage other compromised infrastructure, presumably to make reentry attempts seem legitimate This attempt illustrates the importance of thorough planning when conducting an eviction and the need for continuous vigilance for evidence of reentry Conclusion As of this publication, BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace Its activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems To mitigate these threats, CTU researchers recommend that clients conduct regular internal vulnerability scanning, patching, and upgrading of priority systems, particularly Internet-facing systems and users' devices Early detection and response can minimize exposure and damage Threat indicators The threat indicators in Table 1 are associated with BRONZE UNION activity The IP addresses may contain malicious content, so consider the risks before opening them in a browser BRONZE UNION indicators  ### Response: .