MalwareUsed by 1 actor

Avenger

Avenger is a Windows malware family used by the TICK espionage group, also known as BRONZE BUTLER and REDBALDKNIGHT, during Operation ENDTRADE. It functioned as a multi-stage downloader and selective backdoor delivery mechanism in intrusions targeting organizations in the defense, aerospace, chemical, and satellite sectors, particularly entities headquartered in Japan with subsidiaries in China.

Avenger performs host profiling before delivering follow-on payloads. Reported capabilities include identifying installed antivirus products, enumerating running processes with Tasklist, determining the compromised host’s domain, and collecting host volume information and operating system architecture. It can also browse files and directories on the victim system to gather additional targeting context. Based on this reconnaissance, the malware appears to support selective infection decisions aligned with campaign criteria.

The malware can decrypt files downloaded from command-and-control infrastructure and communicates over HTTP. In documented operations, if a host met targeting requirements, Avenger could retrieve an image containing malware concealed with steganography and extract a backdoor from it. Variants have also been observed injecting shellcode into svchost.exe, indicating use of process injection for execution and defense evasion. Multiple versions and target-specific variants have been identified, including a newer variant associated with the PDB string Avenger2 and a clearer internal code structure.

Avenger was delivered in a broader intrusion workflow that included spearphishing with compromised legitimate email accounts and stolen credentials. Its role within those operations was to assess victim suitability, stage additional payloads, and support covert post-compromise access while attempting to evade security controls.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

Our analysis found that Avenger has a number of variants and versions depending on their targets... We found that the downloader has three stages... If the host doesn’t exist, Avenger will download an image with an embedded malware hidden via steganography and extract a backdoor.

via trend micro blog historicblog.trendmicro.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Adds Autorun to the registry.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence4

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

T1547.001Registry Run Keys / Startup FolderEvidence1

Adds Autorun to the registry.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence4

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.003SteganographyEvidence1

If the host doesn’t exist, Avenger will download an image with an embedded malware hidden via steganography and extract a backdoor.

T1027.013Encrypted/Encoded FileEvidence1

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

T1055Process InjectionEvidence4

T1140Deobfuscate/Decode Files or InformationEvidence7

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Discovery

6 techniques

T1016System Network Configuration DiscoveryEvidence5

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1057Process DiscoveryEvidence4

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1482Domain Trust DiscoveryEvidence1

Avenger collects the victim’s detailed information from the system by browsing the folders, files, and domain information.

T1518.001Security Software DiscoveryEvidence2

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

28 SOURCESView more in app

mitre attack websiteNews

Oct 28, 2025

Updates | MITRE ATT&CK®

... Avenger ... (v1.1→v1.2) ...

mitre attack websiteNews

Oct 28, 2025

Updates - Updates - October 2025 | MITRE ATT&CK®

Avenger (v1.1→v1.2)

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Malware capable of injecting shellcode into svchost.exe.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Identifies the domain of compromised hosts.

+24 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Avenger