Story image

Chinese 'Bronze Butler' group suspected of stealing IP from Japan

17 Oct 2017

A cyber espionage group dubbed ‘BRONZE BUTLER’ or ‘Tick’ may be operating out of the People’s Republic of China (PRC) in order to steal data and intellectual property from organisations and enterprises in Japan.

SecureWorks Counter Threat Unit researchers and incident responders have been following the group’s activities between 2012-2017.

They discovered that Bronze Butler’s operations suggest a long-standing intent to steal information from Japanese organisations, with a heavy focus on the critical infrastructure, heavy industry, manufacturing and international relations networks.

The group has used a combination of spearphishing, strategic web compromises and the exploitation of a zero-day vulnerability to compromise the systems it targets. Because their command and control servers are encrypted, network defenders have faced challenges in stopping the threats.

The spearphishing emails and strategic web compromises (SWCs) are used to compromise target networks and are often conducted using Flash animation attachments and other Flash exploits for SWC attacks.

It has also used the CVE-2016-7836 vulnerability to take advantage of flaws in SKYSEA Client View, a popular IT asset management product in Japan. Bronze Butler may have been taking advantage of the vulnerability since at least June 2016.

When the group is successful in system infiltration, it deletes traces of its activities but still keeps access open for future possible investigation.

SecureWorks researchers say Bronze Butler has exfiltrated a number of different data categories: Intellectual property about technology and development; product specifications; business and sales information; network and system configuration files; email messages and meeting minutes.

They also believe the group is located in the People’s Republic of China because of three main pieces of evidence: The use of T-SMB Scan tools published on a Chinese Developer’s website; Chinese characters in the installation name of an early xxmm backdoor; a drop in the group’s activity during PRC national holidays; and links between the group’s hacking tool and PRC-based NCPH hacking group.

“PRC-based cyberespionage groups have historically sought intellectual property and economic intelligence from competing economies to deliver information which can provide a competitive advantage domestically. The demand for this type of intelligence gathering could be influenced by China’s ambitious economic growth goals,” researchers state.

CTU researchers recommend that organisations, particularly those whose assets and intellectual property could be valuable to BRONZE BUTLER, implement the following security practices:

  • Review proxy log settings to ensure they capture information such as HTTP parameters and User-Agents for future analysis. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity.
  • Use an advanced endpoint threat detection (AETD) solution to monitor activity on network endpoints. Install a background monitor tool (e.g., Sysmon) to log detailed Windows event information to assist with incident response.
  • Implement timely vulnerability patching and system updates. Update SKYSEA Client View implementations to the latest version as soon as possible.
  • Review network access control. In particular, review network access for use of mobile USB modems on corporate systems. Also implement strict security controls for privileged accounts such as Active Directory administrator to prevent access by an unauthorised user.
Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Using data science to improve threat prevention
With a large amount of good quality data and strong algorithms, companies can develop highly effective protective measures.
General staff don’t get tech jargon - expert says time to ditch it
There's a serious gap between IT pros and general staff, and this expert says it's on the people in IT to bridge it.
ZombieLoad: Another batch of flaws affect Intel chips
“This flaw can be weaponised in highly targeted attacks that would normally require system-wide privileges or a complete subversion of the operating system."
Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.