BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.123
- Trend Micro Daserf Nov 2017
- Secureworks BRONZE BUTLER Oct 2017
- Trend Micro Tick November 2019
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | BRONZE BUTLER | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | REDBALDKNIGHT | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Tick | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1005 | Data from Local System | — |
| T1007 | System Service Discovery | — |
| T1018 | Remote System Discovery | — |
| T1027.001 | Binary Padding | — |
| T1027.003 | Steganography | — |
| T1036 | Masquerading | — |
| T1036.002 | Right-to-Left Override | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1039 | Data from Network Shared Drive | — |
| T1053.002 | At | — |
| T1053.005 | Scheduled Task | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1080 | Taint Shared Content | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1102.001 | Dead Drop Resolver | — |
| T1105 | Ingress Tool Transfer | — |
| T1113 | Screen Capture | — |
| T1124 | System Time Discovery | — |
| T1132.001 | Standard Encoding | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1518 | Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1550.003 | Pass the Ticket | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1573.001 | Symmetric Cryptography | — |
| T1574.001 | DLL | — |
| T1588.002 | Tool | — |
| T1685 | Disable or Modify Tools | — |
Aliases
BRONZE BUTLER · REDBALDKNIGHT · Tick
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.