← Back to Actors
BRONZE BUTLER
BRONZE BUTLERREDBALDKNIGHTTick
[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
41
Techniques
40
Covered
1
Gaps
98%
Coverage
Coverage40/41
GAPS (1)
COVERED (40)
T1003.001LSASS Memory111 det.T1005Data from Local System47 det.T1007System Service Discovery15 det.T1018Remote System Discovery50 det.T1027.001Binary Padding3 det.T1027.003Steganography5 det.T1036Masquerading525 det.T1036.002Right-to-Left Override6 det.T1036.005Match Legitimate Resource Name or Location44 det.T1039Data from Network Shared Drive6 det.T1053.002At17 det.T1053.005Scheduled Task99 det.T1059.001PowerShell368 det.T1059.003Windows Command Shell82 det.T1059.005Visual Basic68 det.T1059.006Python49 det.T1070.004File Deletion42 det.T1071.001Web Protocols80 det.T1080Taint Shared Content2 det.T1083File and Directory Discovery48 det.T1087.002Domain Account57 det.T1102.001Dead Drop Resolver7 det.T1105Ingress Tool Transfer183 det.T1113Screen Capture18 det.T1124System Time Discovery4 det.T1132.001Standard Encoding5 det.T1140Deobfuscate/Decode Files or Information58 det.T1189Drive-by Compromise10 det.T1203Exploitation for Client Execution75 det.T1204.002Malicious File425 det.T1518Software Discovery17 det.T1547.001Registry Run Keys / Startup Folder53 det.T1548.002Bypass User Account Control84 det.T1550.003Pass the Ticket13 det.T1560.001Archive via Utility26 det.T1562.001Disable or Modify Tools311 det.T1566.001Spearphishing Attachment905 det.T1574.001DLL109 det.T1588.002Tool13 det.T1685Disable or Modify Tools278 det.