Home / Threat actors / BRONZE BUTLER
BRONZE BUTLER G0060
Also known as: REDBALDKNIGHT, Tick
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
3
associated CVEs
46
Techniques
14
Malware and tools
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
“BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
CVE-2014-4114
High · 7.8
KEV Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
“BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1189 Drive-by CompromiseT1566.001 Spearphishing Attachment Execution
T1053.002 AtT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLL Persistence
T1053.002 AtT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1053.002 AtT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control Stealth
T1027.001 Binary PaddingT1027.003 SteganographyT1036 MasqueradingT1036.002 Right-to-Left OverrideT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1140 Deobfuscate/Decode Files or InformationT1574.001 DLL Defense Impairment
T1685 Disable or Modify Tools Credential Access
T1003.001 LSASS Memory Discovery
T1007 System Service DiscoveryT1018 Remote System DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1124 System Time DiscoveryT1518 Software Discovery Lateral Movement
T1080 Taint Shared ContentT1550.003 Pass the Ticket Collection
T1005 Data from Local SystemT1039 Data from Network Shared DriveT1113 Screen CaptureT1560.001 Archive via Utility Command and Control
T1071.001 Web ProtocolsT1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1132.001 Standard EncodingT1573.001 Symmetric Cryptography © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.