Trusted Design

BRONZE BUTLER

G0060 · MITRE Pageへのリンク

脅威アクターの詳細

[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

別名・別称

BRONZE BUTLER
REDBALDKNIGHT
Tick

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1113 - Screen Capture
• T1132.001 - Standard Encoding
• T1548.002 - Bypass User Account Control
• T1036.005 - Match Legitimate Resource Name or Location
• T1087.002 - Domain Account
• T1204.002 - Malicious File
• T1080 - Taint Shared Content
• T1573.001 - Symmetric Cryptography
• T1566.001 - Spearphishing Attachment
• T1574.001 - DLL
• T1007 - System Service Discovery
• T1005 - Data from Local System
• T1140 - Deobfuscate/Decode Files or Information
• T1036 - Masquerading
• T1027.001 - Binary Padding
• T1003.001 - LSASS Memory
• T1036.002 - Right-to-Left Override
• T1550.003 - Pass the Ticket
• T1083 - File and Directory Discovery
• T1059.001 - PowerShell
• T1547.001 - Registry Run Keys / Startup Folder
• T1588.002 - Tool
• T1562.001 - Disable or Modify Tools
• T1039 - Data from Network Shared Drive
• T1203 - Exploitation for Client Execution
• T1027.003 - Steganography
• T1059.006 - Python
• T1059.003 - Windows Command Shell
• T1070.004 - File Deletion
• T1189 - Drive-by Compromise
• T1071.001 - Web Protocols
• T1059.005 - Visual Basic
• T1018 - Remote System Discovery
• T1518 - Software Discovery
• T1105 - Ingress Tool Transfer
• T1124 - System Time Discovery
• T1053.002 - At
• T1102.001 - Dead Drop Resolver

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1189)
• CVE-2015-5749 (T1560.001)
• CVE-2016-1898 (T1560.001)
• CVE-2016-1897 (T1560.001)
• CVE-2015-7261 (T1560.001)
• CVE-2015-6036 (T1560.001)
• CVE-2015-7262 (T1560.001)
• CVE-2015-0932 (T1560.001)
• CVE-2010-3081 (T1083)
• CVE-2017-16929 (T1083)
• CVE-2025-31125 (T1083)
• CVE-2025-68645 (T1083)
• CVE-2013-3906 (T1203)
• CVE-2015-2546 (T1562.001)
• CVE-2014-4113 (T1562.001)
• CVE-2015-1701 (T1562.001)
• CVE-2017-0263 (T1562.001)
• CVE-2015-0057 (T1562.001)
• CVE-2015-2360 (T1562.001)
• CVE-2008-1436 (T1053.002)
• CVE-2010-0232 (T1203)
• CVE-2010-4398 (T1562.001)
• CVE-2017-0001 (T1083)
• CVE-2014-4114 (T1059.005)
• CVE-2015-1770 (T1059.005)
• CVE-2015-2545 (T1027.003)
• CVE-2017-0199 (T1059.005)
• CVE-2012-0158 (T1059.005)
• CVE-2014-6352 (T1059.005)
• CVE-2015-0016 (T1203)
• CVE-2010-3333 (T1203)
• CVE-2010-0188 (T1059.003)
• CVE-2010-2884 (T1059.003)
• CVE-2013-0640 (T1059.003)
• CVE-2011-0611 (T1059.003)
• CVE-2009-3129 (T1562.001)
• CVE-2010-1553 (T1566.001)
• CVE-2014-1761 (T1203)
• CVE-2015-2853 (T1203)
• CVE-2012-1876 (T1203)
• CVE-2012-2539 (T1203)
• CVE-2013-3660 (T1562.001)
• CVE-2013-7331 (T1018)
• CVE-2013-5990 (T1203)
• CVE-2014-6332 (T1059.005)
• CVE-2012-4792 (T1105)
• CVE-2014-1776 (T1518)
• CVE-2010-0806 (T1105)
• CVE-2012-4969 (T1059.003)
• CVE-2014-8361 (T1071.001)
• CVE-2010-2883 (T1059.003)
• CVE-2012-6422 (T1562.001)
• CVE-2016-6532 (T1003.001)
• CVE-2015-5119 (T1053.002)
• CVE-2014-0329 (T1562.001)
• CVE-2014-4148 (T1562.001)
• CVE-2011-3402 (T1562.001)
• CVE-2015-3043 (T1018)
• CVE-2015-5477 (T1550.003)
• CVE-2015-2852 (T1203)
• CVE-2015-2854 (T1203)
• CVE-2016-1287 (T1562.001)
• CVE-2015-8287 (T1203)
• CVE-2016-9494 (T1562.001)
• CVE-2016-9496 (T1550.003)
• CVE-2016-9495 (T1203)
• CVE-2015-0311 (T1203)
• CVE-2012-3213 (T1203)
• CVE-2014-0497 (T1203)
• CVE-2014-0515 (T1203)
• CVE-2015-0310 (T1203)
• CVE-2014-6324 (T1562.001)
• CVE-2014-2273 (T1562.001)
• CVE-2015-5122 (T1518)
• CVE-2012-1856 (T1059.005)
• CVE-2015-3785 (T1562.001)
• CVE-2015-5897 (T1562.001)
• CVE-2015-3090 (T1203)
• CVE-2015-3113 (T1203)
• CVE-2015-2590 (T1083)
• CVE-2015-2424 (T1083)
• CVE-2015-0097 (T1059.005)
• CVE-2015-2502 (T1189)
• CVE-2014-6271 (T1059.003)
• CVE-2016-1990 (T1083)
• CVE-2016-1991 (T1083)
• CVE-2016-1010 (T1203)
• CVE-2016-1019 (T1083)
• CVE-2016-0984 (T1562.001)
• CVE-2016-1001 (T1203)
• CVE-2016-0998 (T1203)
• CVE-2015-1641 (T1083)
• CVE-2015-0313 (T1203)
• CVE-2015-0359 (T1018)
• CVE-2015-5130 (T1083)
• CVE-2015-5134 (T1083)
• CVE-2015-5539 (T1083)
• CVE-2015-5557 (T1083)
• CVE-2015-5563 (T1083)
• CVE-2015-5559 (T1083)
• CVE-2015-5540 (T1083)
• CVE-2015-5561 (T1083)
• CVE-2015-5551 (T1083)
• CVE-2015-5564 (T1083)
• CVE-2015-5565 (T1083)
• CVE-2015-5550 (T1083)
• CVE-2015-5566 (T1083)
• CVE-2015-5127 (T1083)
• CVE-2015-5556 (T1083)
• CVE-2015-3628 (T1203)
• CVE-2015-6022 (T1083)
• CVE-2017-0261 (T1018)
• CVE-2017-0262 (T1018)
• CVE-2025-55182 (T1562.001)
• CVE-2014-0322 (T1059.005)
• CVE-2012-1258 (T1083)
• CVE-2015-0336 (T1203)
• CVE-2011-3544 (T1083)
• CVE-2014-3153 (T1203)
• CVE-2014-4322 (T1562.001)
• CVE-2015-3636 (T1562.001)
• CVE-2013-6282 (T1562.001)
• CVE-2015-3105 (T1203)
• CVE-2017-17215 (T1083)
• CVE-2013-0074 (T1203)
• CVE-2012-0507 (T1083)
• CVE-2013-2465 (T1083)
• CVE-2014-8439 (T1083)
• CVE-2013-2551 (T1189)
• CVE-2014-0569 (T1083)
• CVE-2014-0556 (T1562.001)
• CVE-2015-5560 (T1083)
• CVE-2015-0071 (T1189)
• CVE-2014-9163 (T1203)
• CVE-2012-1723 (T1083)
• CVE-2015-1761 (T1083)
• CVE-2014-8440 (T1018)
• CVE-2014-7247 (T1203)
• CVE-2013-2678 (T1083)
• CVE-2015-2426 (T1562.001)
• CVE-2014-3393 (T1562.001)
• CVE-2015-4902 (T1083)
• CVE-2014-3897 (T1189)
• CVE-2015-2387 (T1562.001)
• CVE-2010-2572 (T1083)
• CVE-2011-1255 (T1203)
• CVE-2017-8570 (T1059.005)
• CVE-2012-0611 (T1189)
• CVE-2015-2419 (T1189)
• CVE-2016-0189 (T1059.005)
• CVE-2016-4117 (T1203)
• CVE-2017-0143 (T1059.005)
• CVE-2023-1389 (T1018)
• CVE-2025-24893 (T1203)
• CVE-2025-34026 (T1518)
• CVE-2025-55183 (T1562.001)
• CVE-2025-55184 (T1562.001)
• CVE-2025-66478 (T1083)
• CVE-2026-0723 (T1083)
• CVE-2026-20127 (T1562.001)
• CVE-2015-3456 (T1562.001)
• CVE-2015-6034 (T1562.001)
• CVE-2016-1562 (T1562.001)
• CVE-2017-3212 (T1562.001)
• CVE-2014-7911 (T1562.001)
• CVE-2010-1297 (T1059.003)
• CVE-2013-0634 (T1562.001)
• CVE-2013-2595 (T1562.001)
• CVE-2017-7255 (T1018)
• CVE-2015-7645 (T1203)
• CVE-2015-7808 (T1203)
• CVE-2015-7755 (T1203)
• CVE-2013-0641 (T1059.003)
• CVE-2012-4681 (T1124)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る