Threat actor
BRONZE BUTLER
China · espionage
Tracked by CyberSIXT since 31 Oct 2025
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
4 articles from 4 outlets since 31 Oct 2025; the latest 354 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 6 Nov 2025 · 02:15 UTC | Dark Reading | APT 'Bronze Butler' Exploits Zero-Day to Root Japan Orgs |
| Fri 31 Oct 2025 · 14:20 UTC | The Hacker News | China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems |
| Fri 31 Oct 2025 · 11:26 UTC | GBHackers | Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data |
| Fri 31 Oct 2025 · 03:45 UTC | SecurityOnline | Chinese APT BRONZE BUTLER Exploits LANSCOPE Zero-Day for SYSTEM Control |
Who reported 4 outlets
- SecurityOnline1
- GBHackers1
- The Hacker News1
- Dark Reading1
Names and sources
- Tick
- Named by CyberSIXT coverage
- BRONZE BUTLER
- Named by Malpedia · tick
- G0060
- Named by Malpedia · tick
- Nian
- Named by Malpedia · tick
- PLA Unit 61419
- Named by Malpedia · tick
- REDBALDKNIGHT
- Named by Malpedia · tick
- STALKER PANDA
- Named by Malpedia · tick
- Stalker Taurus
- Named by Malpedia · tick
All 32 names
- Swirl Typhoon
- Named by Malpedia · tick
- TEMP.Tick
- Named by Malpedia · tick
- TICK CASTLE
- Named by Malpedia · tick
- Tick
- Named by Malpedia · tick
- Bronze Butler
- Named by Microsoft · Swirl Typhoon
- REDBALDKNIGHT
- Named by Microsoft · Swirl Typhoon
- STALKER PANDA
- Named by Microsoft · Swirl Typhoon
- Swirl Typhoon
- Named by Microsoft · Swirl Typhoon
- TELLURIUM
- Named by Microsoft · Swirl Typhoon
- Tick
- Named by Microsoft · Swirl Typhoon
- BRONZE BUTLER
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- G0060
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- Nian
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- PLA Unit 61419
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- REDBALDKNIGHT
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- STALKER PANDA
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- Stalker Taurus
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- Swirl Typhoon
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- TEMP.Tick
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- TICK CASTLE
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- Tick
- Named by MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8
- BRONZE BUTLER
- Named by MITRE ATT&CK® · G0060
- REDBALDKNIGHT
- Named by MITRE ATT&CK® · G0060
- Tick
- Named by MITRE ATT&CK® · G0060
Attributed facts
- category
- state (Microsoft · Swirl Typhoon)
- motivation
- espionage (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- origin
- China (Microsoft · Swirl Typhoon)
- origin
- China (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Diplomacy (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Engineering (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Industrial (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Infrastructure (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Manufacturing (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- News - Media (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Political party (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sector
- Private sector (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- sponsor
- China (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- Target country
- China (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- Target country
- Japan (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- Target country
- Russian Federation (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
- Target country
- South Korea (MISP Galaxy · add6554a-815a-4ac3-9b22-9337b9661ab8)
Malware and tools
Mimikatz (MITRE ATT&CK® · G0060) Windows Credential Editor (MITRE ATT&CK® · G0060) gsecdump (MITRE ATT&CK® · G0060) Net (MITRE ATT&CK® · G0060) cmd (MITRE ATT&CK® · G0060) at (MITRE ATT&CK® · G0060) schtasks (MITRE ATT&CK® · G0060) Daserf (MITRE ATT&CK® · G0060) ABK (MITRE ATT&CK® · G0060) BBK (MITRE ATT&CK® · G0060) build_downer (MITRE ATT&CK® · G0060) down_new (MITRE ATT&CK® · G0060) Avenger (MITRE ATT&CK® · G0060) ShadowPad (MITRE ATT&CK® · G0060) NodeRAT (Malpedia · tick) 8.t Dropper (Malpedia · tick) BROLER (Malpedia · tick) Daserf (Malpedia · tick) Datper (Malpedia · tick) Lilith (Malpedia · tick) rarstar (Malpedia · tick) xxmm (Malpedia · tick)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0060
Tactics pending refresh
- T1003.001
- LSASS Memory
- T1005
- Data from Local System
- T1007
- System Service Discovery
- T1018
- Remote System Discovery
- T1027.001
- Binary Padding
- T1027.003
- Steganography
- T1036
- Masquerading
- T1036.002
- Right-to-Left Override
- T1036.005
- Match Legitimate Resource Name or Location
- T1039
- Data from Network Shared Drive
- T1053.005
- Scheduled Task
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- APT 'Bronze Butler' Exploits Zero-Day to Root Japan OrgsDark Reading
- China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate SystemsThe Hacker News
- Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential DataGBHackers
- Chinese APT BRONZE BUTLER Exploits LANSCOPE Zero-Day for SYSTEM ControlSecurityOnline · first in our coverage