H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

BRONZE BUTLER

[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

54 recorded

Relationships

uses
to ABK
Malware
uses
to Archive via Utility
Technique
uses
to at
Tool
uses
to At
Technique
uses
to Avenger
Malware
uses
to BBK
Malware
uses
to Binary Padding
Technique
uses
to build_downer
Malware
uses
to Bypass User Account Control
Technique
uses
to cmd
Tool
uses
to Daserf
Malware
uses
to Data from Local System
Technique
uses
to Data from Network Shared Drive
Technique
uses
to Dead Drop Resolver
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Disable or Modify Tools
Technique
uses
to DLL
Technique
uses
to Domain Account
Technique
uses
to down_new
Malware
uses
to Drive-by Compromise
Technique
uses
to Exploitation for Client Execution
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to gsecdump
Tool
uses
to Ingress Tool Transfer
Technique
uses
to LSASS Memory
Technique
uses
to Malicious File
Technique
uses
to Masquerading
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Mimikatz
Tool
uses
to Net
Tool
uses
to Pass the Ticket
Technique
uses
to PowerShell
Technique
uses
to Python
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Remote System Discovery
Technique
uses
to Right-to-Left Override
Technique
uses
to Scheduled Task
Technique
uses
to schtasks
Tool
uses
to Screen Capture
Technique
uses
to ShadowPad
Malware
uses
to Software Discovery
Technique
uses
to Spearphishing Attachment
Technique
uses
to Standard Encoding
Technique
uses
to Steganography
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Service Discovery
Technique
uses
to System Time Discovery
Technique
uses
to Taint Shared Content
Technique
uses
to Tool
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Credential Editor
Tool
8 external

References

mitre-attack
G0060
open
BRONZE BUTLER
—
REDBALDKNIGHT
—
Tick
—
Trend Micro Daserf Nov 2017
http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/
open
Secureworks BRONZE BUTLER Oct 2017
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
open
Trend Micro Tick November 2019
https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf
open
Symantec Tick Apr 2016
https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance