LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

EnterpriseG0060GroupObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0060: BRONZE BUTLER describes [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

Executive priority

G0060: BRONZE BUTLER is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0060: BRONZE BUTLER by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0060: BRONZE BUTLER appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

40 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or Information

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.[2]

EnterpriseT1005Data from Local System

BRONZE BUTLER has exfiltrated files stolen from local systems.[2]

EnterpriseT1007System Service Discovery

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.[3]

EnterpriseT1070.004File DeletionSub-technique

The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.[2]

EnterpriseT1059.006PythonSub-technique

BRONZE BUTLER has made use of Python-based remote access tools.[3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.[4][3]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.[2]

EnterpriseT1113Screen Capture

BRONZE BUTLER has used a tool to capture screenshots.[2][3]

EnterpriseT1036Masquerading

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.[3]

EnterpriseT1588.002ToolSub-technique

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.[4]

EnterpriseT1548.002Bypass User Account ControlSub-technique

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.[2][3]

EnterpriseT1059.005Visual BasicSub-technique

BRONZE BUTLER has used VBS and VBE scripts for execution.[2][3]

EnterpriseT1132.001Standard EncodingSub-technique

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.[2]

EnterpriseT1518Software Discovery

BRONZE BUTLER has used tools to enumerate software installed on an infected host.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

BRONZE BUTLER malware has used HTTP for C2.[2]

EnterpriseT1039Data from Network Shared Drive

BRONZE BUTLER has exfiltrated files stolen from file shares.[2]

EnterpriseT1685Disable or Modify Tools

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.[3]

EnterpriseT1124System Time Discovery

BRONZE BUTLER has used net time to check the local time on a target system.[2]

EnterpriseT1189Drive-by Compromise

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.[4]

EnterpriseT1574.001DLLSub-technique

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.[3]

EnterpriseT1003.001LSASS MemorySub-technique

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.[2]

EnterpriseT1203Exploitation for Client Execution

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.[4][3]

EnterpriseT1018Remote System Discovery

BRONZE BUTLER typically use ping and Net to enumerate systems.[2]

EnterpriseT1560.001Archive via UtilitySub-technique

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.[2][3]

EnterpriseT1053.002AtSub-technique

BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.[2]

EnterpriseT1102.001Dead Drop ResolverSub-technique

BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.[2]

EnterpriseT1053.005Scheduled TaskSub-technique

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.[2]

EnterpriseT1080Taint Shared Content

BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.[2]

EnterpriseT1204.002Malicious FileSub-technique

BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.[4][3]

EnterpriseT1027.001Binary PaddingSub-technique

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.[2][3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.[2]

EnterpriseT1059.001PowerShellSub-technique

BRONZE BUTLER has used PowerShell for execution.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

BRONZE BUTLER has used batch scripts and the command-line interface for execution.[2]

EnterpriseT1105Ingress Tool Transfer

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).[2]

EnterpriseT1550.003Pass the TicketSub-technique

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.[2]

EnterpriseT1573.001Symmetric CryptographySub-technique

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.[2]

EnterpriseT1027.003SteganographySub-technique

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.[3]

EnterpriseT1087.002Domain AccountSub-technique

BRONZE BUTLER has used net user /domain to identify account information.[2]

EnterpriseT1083File and Directory Discovery

BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.[2]

EnterpriseT1036.002Right-to-Left OverrideSub-technique

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.[3]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
ToolEnterprise

S0106: cmd

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. [1]

Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir [2]), deleting files (e.g., del [3]), and copying files (e.g., copy [4]).

Windows
ToolEnterprise

S0110: at

at is used to schedule tasks on a system to run at a specified date or time.[1][2]

LinuxWindowsmacOS
ToolEnterprise

S0111: schtasks

schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. [1]

Windows
MalwareEnterprise

S0187: Daserf

Daserf is a backdoor that has been used to spy on and steal from Japanese, South Korean, Russian, Singaporean, and Chinese victims. Researchers have identified versions written in both Visual C and Delphi. [1] [2]

Windows
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
MalwareEnterprise

S0596: ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · MalwareS0471: build_downerEnterpriseuses · ToolS0106: cmdEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1039: Data from Network Shared DriveEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · MalwareS0469: ABKEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · ToolS0110: atEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.3
Created
Modified
Raw hash
8140b87f328c357b...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.3Current bundle8140b87f328c…
19.11.3Older bundle05416eb8afb6…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Trend Micro Daserf Nov 2017

    Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017.

  2. [2]
    Secureworks BRONZE BUTLER Oct 2017

    Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.

    Open source URL
  3. [3]
    Trend Micro Tick November 2019

    Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.

    Open source URL
  4. [4]
    Symantec Tick Apr 2016

    DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.

    Open source URL
  5. [5]
    BRONZE BUTLER

    (Citation: Trend Micro Daserf Nov 2017)(Citation: Trend Micro Tick November 2019)

  6. [6]
    REDBALDKNIGHT

    (Citation: Trend Micro Daserf Nov 2017)(Citation: Trend Micro Tick November 2019)

  7. [7]
    Tick

    (Citation: Trend Micro Daserf Nov 2017)(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)

  8. [8]
    mitre-attackG0060
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use