A cyber espionage group dubbed ‘BRONZE BUTLER’ or ‘Tick’ may be operating out of the People’s Republic of China (PRC) in order to steal data and intellectual property from organisations and enterprises in Japan.
SecureWorks Counter Threat Unit researchers and incident responders have been following the group’s activities between 2012-2017.
They discovered that Bronze Butler’s operations suggest a long-standing intent to steal information from Japanese organisations, with a heavy focus on the critical infrastructure, heavy industry, manufacturing and international relations networks.
The group has used a combination of spearphishing, strategic web compromises and the exploitation of a zero-day vulnerability to compromise the systems it targets. Because their command and control servers are encrypted, network defenders have faced challenges in stopping the threats.
The spearphishing emails and strategic web compromises (SWCs) are used to compromise target networks and are often conducted using Flash animation attachments and other Flash exploits for SWC attacks.
It has also used the CVE-2016-7836 vulnerability to take advantage of flaws in SKYSEA Client View, a popular IT asset management product in Japan. Bronze Butler may have been taking advantage of the vulnerability since at least June 2016.
When the group is successful in system infiltration, it deletes traces of its activities but still keeps access open for future possible investigation.
SecureWorks researchers say Bronze Butler has exfiltrated a number of different data categories: Intellectual property about technology and development; product specifications; business and sales information; network and system configuration files; email messages and meeting minutes.
They also believe the group is located in the People’s Republic of China because of three main pieces of evidence: The use of T-SMB Scan tools published on a Chinese Developer’s website; Chinese characters in the installation name of an early xxmm backdoor; a drop in the group’s activity during PRC national holidays; and links between the group’s hacking tool and PRC-based NCPH hacking group.
“PRC-based cyberespionage groups have historically sought intellectual property and economic intelligence from competing economies to deliver information which can provide a competitive advantage domestically. The demand for this type of intelligence gathering could be influenced by China’s ambitious economic growth goals,” researchers state.
CTU researchers recommend that organisations, particularly those whose assets and intellectual property could be valuable to BRONZE BUTLER, implement the following security practices: