216.73.217.22

BRONZE BUTLER

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:13
Updated at
27/03/2026 01:13
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
1 reports, 68 attack patterns (mitre), 14 malware, 2 sectors, 1 countries, 5 indicators, 1 vulnerabilities (cve), 7 tool

Aliases

REDBALDKNIGHT Tick

Description

[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (68)

Malware (14)

  • POISONPLUG.SHADOW uses
    Family
    Published 30/04/2026 19:11 · Modified 30/04/2026 19:11
  • Tick
  • OAED Loader uses
    Family
    Published 31/10/2025 02:16 · Modified 31/10/2025 02:16
  • Avenger
  • build_downer
  • Havoc uses
    Family
    Published 08/06/2026 10:30 · Modified 08/06/2026 10:30
  • Daserf
  • ShadowPy
  • Gokcpdoor uses
    Family
    Published 31/10/2025 02:16 · Modified 31/10/2025 02:16
  • ABK
  • ReVBShell
  • BBK
  • down_new
  • Netboy

Sectors (2)

  • Defense ministries (including the military) targets
  • Government targets

Countries (1)

  • Japan targets

Indicators (5)

Vulnerabilities (CVE) (1)

CVE-2025-61932 KEV
9.3 Critical

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to …

Published
22/10/2025
Modified
21/12/2025
Received

Tool (7)

  • Net uses
    The MITRE Corporation Confidence 100

    The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • cmd uses
    The MITRE Corporation Confidence 100

    [cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd) Cmd.exe contains native functionality to …

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • at uses
    The MITRE Corporation Confidence 100

    [at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time.(Citation: TechNet At)(Citation: Linux at)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • schtasks uses
    The MITRE Corporation Confidence 100

    [schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • gsecdump uses
    The MITRE Corporation Confidence 100

    [gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Windows Credential Editor uses
    The MITRE Corporation Confidence 100

    [Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07