CVE Intelligence
Início / Grupos de ameaça / BRONZE BUTLER

BRONZE BUTLER G0060

🔔 Criar alerta

Também conhecido como: REDBALDKNIGHT, Tick

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

3
CVEs associadas
46
Técnicas
14
Malwares e ferramentas

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2018-0802 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
CVE-2018-0798 Alta · 8.8 KEV Microsoft Office Memory Corruption Vulnerability
“BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
CVE-2014-4114 Alta · 7.8 KEV Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
“BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”

Técnicas por tática

Desenvolvimento de recursos
T1588.002 Tool
Acesso inicial
T1189 Drive-by CompromiseT1566.001 Spearphishing Attachment
Execução
T1053.002 AtT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLL
Persistência
T1053.002 AtT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1053.002 AtT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Furtividade
T1027.001 Binary PaddingT1027.003 SteganographyT1036 MasqueradingT1036.002 Right-to-Left OverrideT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1140 Deobfuscate/Decode Files or InformationT1574.001 DLL
Comprometimento de defesas
T1685 Disable or Modify Tools
Acesso a credenciais
T1003.001 LSASS Memory
Descoberta
T1007 System Service DiscoveryT1018 Remote System DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1124 System Time DiscoveryT1518 Software Discovery
Movimento lateral
T1080 Taint Shared ContentT1550.003 Pass the Ticket
Coleta
T1005 Data from Local SystemT1039 Data from Network Shared DriveT1113 Screen CaptureT1560.001 Archive via Utility
Comando e controle
T1071.001 Web ProtocolsT1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1132.001 Standard EncodingT1573.001 Symmetric Cryptography

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.