MalwareUsed by 1 actor

ABK

ABK is a Windows downloader associated with the China-linked espionage group Tick, also tracked as BRONZE BUTLER. It has been in use since at least 2019 and has been observed as part of multi-stage intrusions in which it is deployed alongside other tooling, including loaders and backdoors. ABK is designed to stage and execute follow-on malware while collecting basic host profiling data to support operator decision-making and defense evasion.

ABK can decrypt AES-encrypted payloads, extract a malicious PE payload concealed within an image, and download additional files from command-and-control infrastructure. It has been observed using HTTP for command-and-control communications and can invoke the Windows command shell to execute a PE on a compromised host. The malware also performs security software discovery by identifying the installed antivirus product on the victim system. For execution and stealth, ABK can inject shellcode into svchost.exe.

Reporting on related intrusion chains indicates ABK has been delivered as an encrypted payload by a loader that decrypts and launches it, after which ABK performs host reconnaissance and retrieves subsequent malware. It has been found on servers and workstations in intrusions affecting organizations in Japan. Its use aligns with long-running Chinese cyber-espionage tradecraft focused on covert access, staged payload delivery, and post-compromise expansion within victim environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

via secureworkssecureworks.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Privilege Escalation

1 technique

T1055Process InjectionEvidence5

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

Stealth

3 techniques

T1027.003SteganographyEvidence1

T1055Process InjectionEvidence5

T1140Deobfuscate/Decode Files or InformationEvidence8

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Discovery

1 technique

T1518.001Security Software DiscoveryEvidence3

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence6

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Malware capable of injecting shellcode into svchost.exe.

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware capable of decrypting AES-encrypted payloads.

mitre attack websiteNews

Jan 1, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware capable of decrypting AES-encrypted payloads.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ABK