BRONZE BUTLER
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.
- ATT&CK ID
- G0060
- Origin
- China
- Techniques
- 33
- Tools
- 14
Also tracked as REDBALDKNIGHT · Tick
Vulnerabilities it has exploited
- CVE-2014-4114 Microsoft WindowsUnscored · exploited in the wild
- CVE-2018-0798 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0802 Microsoft OfficeUnscored · exploited in the wild
Techniques
Resource Development
Initial Access
Execution
Scheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalDeobfuscate/Decode Files or InformationHijack Execution Flow
Defense Impairment
Credential Access
Discovery
System Service DiscoveryRemote System DiscoveryFile and Directory DiscoveryAccount DiscoverySystem Time DiscoverySoftware Discovery
Lateral Movement
Taint Shared ContentUse Alternate Authentication Material
Collection
Data from Local SystemData from Network Shared DriveScreen CaptureArchive Collected Data
Command and Control
Application Layer ProtocolWeb ServiceIngress Tool TransferData EncodingEncrypted Channel
Software
ABK · Avenger · BBK · Daserf · Mimikatz · Net · ShadowPad · Windows Credential Editor · at · build_downer · cmd · down_new · gsecdump · schtasks