BRONZE BUTLER

Names and who uses them

• BRONZE BUTLEROur name
• REDBALDKNIGHTTrend Micro
• TickTrend Micro

Targets

Sectors: Government, Manufacturing

Regions: Japan

Known techniques

• T1003.001LSASS Memory
• T1005Data from Local System
• T1007System Service Discovery
• T1018Remote System Discovery
• T1027.001Binary Padding
• T1027.003Steganography
• T1036Masquerading
• T1036.002Right-to-Left Override
• T1036.005Match Legitimate Resource Name or Location
• T1039Data from Network Shared Drive
• T1053.002At
• T1053.005Scheduled Task
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.006Python
• T1070.004File Deletion
• T1071.001Web Protocols
• T1080Taint Shared Content
• T1083File and Directory Discovery
• T1087.002Domain Account
• T1102.001Dead Drop Resolver
• T1105Ingress Tool Transfer
• T1113Screen Capture
• T1124System Time Discovery
• T1132.001Standard Encoding
• T1140Deobfuscate/Decode Files or Information
• T1189Drive-by Compromise
• T1203Exploitation for Client Execution
• T1204.002Malicious File
• T1518Software Discovery
• T1547.001Registry Run Keys / Startup Folder
• T1548.002Bypass User Account Control
• T1550.003Pass the Ticket
• T1560.001Archive via Utility
• T1566.001Spearphishing Attachment
• T1573.001Symmetric Cryptography
• T1574.001DLL
• T1588.002Tool
• T1685Disable or Modify Tools

Malware and tools used