H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

BBK

[BBK](https://attack.mitre.org/software/S0470) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[BBK](https://attack.mitre.org/software/S0470) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)

Labels

malware
8 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Native API
Technique
uses
to Process Injection
Technique
uses
to Steganography
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
from BRONZE BUTLER
Group
2 external

References

mitre-attack
S0470
open
Trend Micro Tick November 2019
https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance