BRONZE BUTLER

Tick, also known as BRONZE BUTLER, RedBaldKnight, Stalker Panda, Stalker Taurus, Swirl Typhoon, and Tellurium, is a China-linked cyberespionage group with documented activity dating to at least 2006. It primarily targets organizations in Japan and South Korea to steal intellectual property and sensitive or classified information. Its targets include technology companies, engineering firms, and broadcasting organizations. Operations emphasize selective targeting and sustained access, with documented intrusions lasting up to 18 months. The group gains access through spearphishing with malicious Microsoft Word attachments, watering-hole attacks using compromised websites, and exploitation of internet-facing software. It exploited Microsoft Exchange ProxyLogon vulnerabilities before patches became available in 2021. Its malware arsenal has included the Gofarer downloader and custom backdoors such as Daserf, Datper, and xxmm. Tick has also used the modular ShadowPad backdoor since 2018, supplementing it with customized post-compromise tools. Tick uses Windows command shells and batch scripts, establishes persistence through Registry autostart mechanisms, and enumerates network systems with native utilities. It harvests credentials using Mimikatz, GSecdump, and Windows Credential Editor. Lateral movement includes scheduled-task execution and placing malware on shared storage under names matching legitimate documents. Defense-evasion methods include encoded payloads, executables disguised with document icons, and stolen code-signing certificates. The group collects emails and business documents and stages stolen information in password-protected RAR archives before exfiltration.