Datper

Datper is a Windows backdoor associated with the China-linked espionage group TICK, also tracked as BRONZE BUTLER. It has been observed in long-running intrusion activity targeting Japanese organizations and featured in later TICK operations against defense, aerospace, chemical, and satellite-sector entities with business ties between Japan and China. Datper appears in TICK’s broader malware ecosystem alongside tools such as Wali, xxmm, down_new, Casper, and ShadowPad.

Observed use places Datper in targeted espionage operations rather than broad criminal distribution. Prior to March 2018, attackers used Wali and a small downloader to spread xxmm and Datper in campaigns exploiting Japanese enterprise software. In Operation ENDTRADE-era activity, Datper variants were deployed as part of spear-phishing-led compromises that relied on stolen legitimate email accounts and Japanese-language lures. Multiple Datper variants were observed from late 2017 onward.

Datper functions as a backdoor that retrieves information from infected hosts and supports post-compromise access for the operator. Reported variant evolution includes adjusted mutex usage and changes to cryptographic implementation, including a modified RC4 initialization, as well as new parameters intended to reduce signature-based antivirus detection. Its development pattern is consistent with TICK’s emphasis on iterative malware refinement, defense evasion, and sustained access in high-value enterprise environments.

Datper has been linked to campaigns focused on Japanese government and private-sector targets, especially organizations holding military, industrial, or proprietary information. Its operational context indicates use in espionage intrusions aimed at intelligence collection and follow-on access within victim networks.