Threat Actor Profile
High
APT
Description
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
Confidence Score
Known Aliases
BRONZE BUTLER
REDBALDKNIGHT
Tick
Tags
mitre-attack
stix-2.1
intrusion-set
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (40)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['BRONZE BUTLER', 'REDBALDKNIGHT', 'Tick'],
'created': '2018-01-16T16:13:52.465Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a '
'cyber espionage group with likely Chinese origins that has '
'been active since at least 2008. The group primarily targets '
'Japanese organizations, particularly those in government, '
'biotechnology, electronics manufacturing, and industrial '
'chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: '
'Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro '
'Tick November 2019)',
'external_references': [{'external_id': 'G0060',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G0060'},
{'description': '(Citation: Trend Micro Daserf Nov '
'2017)(Citation: Trend Micro Tick '
'November 2019)',
'source_name': 'BRONZE BUTLER'},
{'description': '(Citation: Trend Micro Daserf Nov '
'2017)(Citation: Trend Micro Tick '
'November 2019)',
'source_name': 'REDBALDKNIGHT'},
{'description': '(Citation: Trend Micro Daserf Nov '
'2017)(Citation: Symantec Tick Apr '
'2016)(Citation: Trend Micro Tick '
'November 2019)',
'source_name': 'Tick'},
{'description': 'Chen, J. and Hsieh, M. (2017, '
'November 7). REDBALDKNIGHT/BRONZE '
'BUTLER’s Daserf Backdoor Now Using '
'Steganography. Retrieved December '
'27, 2017.',
'source_name': 'Trend Micro Daserf Nov 2017',
'url': 'http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/'},
{'description': 'Counter Threat Unit Research Team. '
'(2017, October 12). BRONZE BUTLER '
'Targets Japanese Enterprises. '
'Retrieved January 4, 2018.',
'source_name': 'Secureworks BRONZE BUTLER Oct 2017',
'url': 'https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses'},
{'description': 'Chen, J. et al. (2019, November). '
'Operation ENDTRADE: TICK’s '
'Multi-Stage Backdoors for Attacking '
'Industries and Stealing Classified '
'Data. Retrieved June 9, 2020.',
'source_name': 'Trend Micro Tick November 2019',
'url': 'https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf'},
{'description': 'DiMaggio, J. (2016, April 28). Tick '
'cyberespionage group zeros in on '
'Japan. Retrieved July 16, 2018.',
'source_name': 'Symantec Tick Apr 2016',
'url': 'https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan'}],
'id': 'intrusion-set--93f52415-0fe4-4d3d-896c-fc9b8e88ab90',
'modified': '2025-04-25T14:48:57.719Z',
'name': 'BRONZE BUTLER',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Trend Micro Incorporated'],
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '1.3'}