- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, National University of Defense and Technology
- Agency named
- PLA
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2006–2026
- Status
- Active
- ATT&CK
- G0060 · 40 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0115 · bronze-butler
ChinaWhat it is
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Bronze Butler, Tick, RedBaldNight, Stalker Panda, Stalker Panda
- Government agency
- PLA Unit 61419
- Mandiant
- TEMP.Tick
- Microsoft
- Swirl Typhoon
- MITRE ATT&CK
- G0060
- Secureworks
- CTG-2006
- Operations
- Operation “ENDTRADE”
- Other names
- TempTick, Tick, Nian, REDBALDKNIGHT, RedBaldNight, Stalker Taurus, TELLURIUM, TICK CASTLE
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- China, Hong Kong, Japan, Russia, Russian Federation, Singapore, South Korea, Taiwan, United States
- Sectors
- Critical infrastructure, Defense, Diplomacy, Engineering, Government, High-Tech, Industrial, Infrastructure, Manufacturing, Media, News - Media, Political party, Private sector, Technology
Tools
The tools and malware families the sources tie to it.
- ABK
- Avenger
- BBK
- Cyber Eye RAT
- CyberGate
- Daserf
- Mimikatz
- Net
- SPACESHIP
- ShadowPad
- UNITEDRAKE
- Windows Credential Editor
- at
- build_downer
- cmd
- down_new
- gsecdump
- schtasks
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de