Trusted Design

BRONZE BUTLER

アクターID: G0060

· MITRE Pageへのリンク

脅威アクターの詳細

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

脅威アクターの別名・別称

BRONZE BUTLER
REDBALDKNIGHT
Tick

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1156 - Malicious Shell Modification
• T1161 - LC_LOAD_DYLIB Addition
• T1568.002 - Domain Generation Algorithms
• T1218.013 - Mavinject
• T1587.001 - Malware
• T1087.002 - Domain Account
• T1591.003 - Identify Business Tempo
• T1071.005 - Publish/Subscribe Protocols
• T1598.003 - Spearphishing Link
• T1089 - Disabling Security Tools
• T1003.007 - Proc Filesystem
• T1584.003 - Virtual Private Server
• T1059.010 - AutoHotKey & AutoIT
• T1558 - Steal or Forge Kerberos Tickets
• T1580 - Cloud Infrastructure Discovery
• T1546.005 - Trap
• T1685.005 - Clear Windows Event Logs
• T1592.004 - Client Configurations
• T1219.001 - IDE Tunneling
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1597 - Search Closed Sources
• T1542.004 - ROMMONkit
• T1218.010 - Regsvr32
• T1562.011 - Spoof Security Alerting
• T1027.004 - Compile After Delivery
• T1591.004 - Identify Roles
• T1070.009 - Clear Persistence
• T1059.012 - Hypervisor CLI
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1134 - Access Token Manipulation
• T1159 - Launch Agent
• T1547.013 - XDG Autostart Entries
• T1578.001 - Create Snapshot
• T1591.001 - Determine Physical Locations
• T1008 - Fallback Channels

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1059.012)
• CVE-2015-5749 (T1560.001)
• CVE-2016-1898 (T1560.001)
• CVE-2016-1897 (T1560.001)
• CVE-2015-7261 (T1560.001)
• CVE-2015-6036 (T1560.001)
• CVE-2015-7262 (T1560.001)
• CVE-2015-0932 (T1560.001)
• CVE-2010-3081 (T1219.001)
• CVE-2017-16929 (T1219.001)
• CVE-2025-31125 (T1219.001)
• CVE-2025-68645 (T1219.001)
• CVE-2013-3906 (T1218.010)
• CVE-2015-2546 (T1597)
• CVE-2014-4113 (T1597)
• CVE-2015-1701 (T1597)
• CVE-2017-0263 (T1597)
• CVE-2015-0057 (T1597)
• CVE-2015-2360 (T1597)
• CVE-2008-1436 (T1591.001)
• CVE-2010-0232 (T1218.010)
• CVE-2010-4398 (T1597)
• CVE-2017-0001 (T1219.001)
• CVE-2014-4114 (T1027.010)
• CVE-2015-1770 (T1027.010)
• CVE-2015-2545 (T1562.011)
• CVE-2017-0199 (T1027.010)
• CVE-2012-0158 (T1027.010)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1218.010)
• CVE-2010-3333 (T1218.010)
• CVE-2010-0188 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2011-0611 (T1591.004)
• CVE-2009-3129 (T1597)
• CVE-2010-1553 (T1598.003)
• CVE-2014-1761 (T1218.010)
• CVE-2015-2853 (T1218.010)
• CVE-2012-1876 (T1218.010)
• CVE-2012-2539 (T1218.010)
• CVE-2013-3660 (T1597)
• CVE-2013-7331 (T1134)
• CVE-2013-5990 (T1218.010)
• CVE-2014-6332 (T1027.010)
• CVE-2012-4792 (T1547.013)
• CVE-2014-1776 (T1159)
• CVE-2010-0806 (T1547.013)
• CVE-2012-4969 (T1591.004)
• CVE-2014-8361 (T1556.005)
• CVE-2010-2883 (T1591.004)
• CVE-2012-6422 (T1597)
• CVE-2016-6532 (T1546.005)
• CVE-2015-5119 (T1591.001)
• CVE-2014-0329 (T1597)
• CVE-2014-4148 (T1597)
• CVE-2011-3402 (T1597)
• CVE-2015-3043 (T1134)
• CVE-2015-5477 (T1592.004)
• CVE-2015-2852 (T1218.010)
• CVE-2015-2854 (T1218.010)
• CVE-2016-1287 (T1597)
• CVE-2015-8287 (T1218.010)
• CVE-2016-9494 (T1597)
• CVE-2016-9496 (T1592.004)
• CVE-2016-9495 (T1218.010)
• CVE-2015-0311 (T1218.010)
• CVE-2012-3213 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2014-6324 (T1597)
• CVE-2014-2273 (T1597)
• CVE-2015-5122 (T1159)
• CVE-2012-1856 (T1027.010)
• CVE-2015-3785 (T1597)
• CVE-2015-5897 (T1597)
• CVE-2015-3090 (T1218.010)
• CVE-2015-3113 (T1218.010)
• CVE-2015-2590 (T1219.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1027.010)
• CVE-2015-2502 (T1059.012)
• CVE-2014-6271 (T1591.004)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1219.001)
• CVE-2016-1010 (T1218.010)
• CVE-2016-1019 (T1219.001)
• CVE-2016-0984 (T1597)
• CVE-2016-1001 (T1218.010)
• CVE-2016-0998 (T1218.010)
• CVE-2015-1641 (T1219.001)
• CVE-2015-0313 (T1218.010)
• CVE-2015-0359 (T1134)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1218.010)
• CVE-2015-6022 (T1219.001)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2025-55182 (T1597)
• CVE-2014-0322 (T1027.010)
• CVE-2012-1258 (T1219.001)
• CVE-2015-0336 (T1218.010)
• CVE-2011-3544 (T1219.001)
• CVE-2014-3153 (T1218.010)
• CVE-2014-4322 (T1597)
• CVE-2015-3636 (T1597)
• CVE-2013-6282 (T1597)
• CVE-2015-3105 (T1218.010)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1218.010)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2014-8439 (T1219.001)
• CVE-2013-2551 (T1059.012)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0556 (T1597)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0071 (T1059.012)
• CVE-2014-9163 (T1218.010)
• CVE-2012-1723 (T1219.001)
• CVE-2015-1761 (T1219.001)
• CVE-2014-8440 (T1134)
• CVE-2014-7247 (T1218.010)
• CVE-2013-2678 (T1219.001)
• CVE-2015-2426 (T1597)
• CVE-2014-3393 (T1597)
• CVE-2015-4902 (T1219.001)
• CVE-2014-3897 (T1059.012)
• CVE-2015-2387 (T1597)
• CVE-2010-2572 (T1219.001)
• CVE-2011-1255 (T1218.010)
• CVE-2017-8570 (T1027.010)
• CVE-2012-0611 (T1059.012)
• CVE-2015-2419 (T1059.012)
• CVE-2016-0189 (T1027.010)
• CVE-2016-4117 (T1218.010)
• CVE-2017-0143 (T1027.010)
• CVE-2023-1389 (T1134)
• CVE-2025-24893 (T1218.010)
• CVE-2025-34026 (T1159)
• CVE-2025-55183 (T1597)
• CVE-2025-55184 (T1597)
• CVE-2025-66478 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2026-20127 (T1597)
• CVE-2015-3456 (T1597)
• CVE-2015-6034 (T1597)
• CVE-2016-1562 (T1597)
• CVE-2017-3212 (T1597)
• CVE-2014-7911 (T1597)
• CVE-2010-1297 (T1591.004)
• CVE-2013-0634 (T1597)
• CVE-2013-2595 (T1597)
• CVE-2017-7255 (T1134)
• CVE-2015-7645 (T1218.010)
• CVE-2015-7808 (T1218.010)
• CVE-2015-7755 (T1218.010)
• CVE-2013-0641 (T1591.004)
• CVE-2012-4681 (T1578.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る