MalwareUsed by 1 actor

BBK

BBK is a Windows malware family associated with the China-linked espionage group BRONZE BUTLER, also known as Tick. Reported behavior indicates that it functions as a backdoor used in targeted intrusions. BBK can decrypt AES-encrypted payloads, extract a malicious portable executable hidden within an image, download additional files from command-and-control infrastructure, and communicate with command and control over HTTP. For execution, it can invoke cmd to run a portable executable on a compromised host and use the CreatePipe API to spawn a subprocess through the command shell. BBK also supports process injection, including injecting shellcode into svchost.exe, which is consistent with defense evasion and post-compromise execution tradecraft seen in espionage operations. The malware has been linked to campaigns focused on covert access and follow-on payload delivery within victim environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

via secureworkssecureworks.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe.

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence3

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Privilege Escalation

1 technique

T1055Process InjectionEvidence5

The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.

Stealth

3 techniques

T1027.003SteganographyEvidence1

T1055Process InjectionEvidence5

T1140Deobfuscate/Decode Files or InformationEvidence8

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Malware capable of injecting shellcode into svchost.exe.

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware capable of decrypting AES-encrypted payloads.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that uses CreatePipe to spawn a subprocess through cmd.

+12 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BBK