BRONZE BUTLER
- ID
- G0060
- Associated names
- REDBALDKNIGHT, Tick
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]
Techniques used (40)
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1007 System Service Discovery
- T1018 Remote System Discovery
- T1027.001 Binary Padding
- T1027.003 Steganography
- T1036 Masquerading
- T1036.002 Right-to-Left Override
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1053.002 At
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1080 Taint Shared Content
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1102.001 Dead Drop Resolver
- T1105 Ingress Tool Transfer
- T1113 Screen Capture
- T1124 System Time Discovery
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1518 Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1550.003 Pass the Ticket
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1573.001 Symmetric Cryptography
- T1574.001 DLL
- T1588.002 Tool
- T1685 Disable or Modify Tools
Software used (14)
- S0002 Mimikatz
- S0005 Windows Credential Editor
- S0008 gsecdump
- S0039 Net
- S0106 cmd
- S0110 at
- S0111 schtasks
- S0187 Daserf
- S0469 ABK
- S0470 BBK
- S0471 build_downer
- S0472 down_new
- S0473 Avenger
- S0596 ShadowPad