BRONZE BUTLER
IntrusionSet · ATTACK:enterprise:G0060
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0060",
"title": "BRONZE BUTLER",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0060",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--93f52415-0fe4-4d3d-896c-fc9b8e88ab90",
"external_id": "G0060",
"domain": "enterprise",
"created": "2018-01-16T16:13:52.465Z",
"modified": "2026-07-31T18:48:09.344Z",
"version": "1.3",
"aliases": [
"BRONZE BUTLER",
"REDBALDKNIGHT",
"Tick"
],
"tactics": [
],
"source_references": [
{
"source_name": "BRONZE BUTLER"
},
{
"source_name": "REDBALDKNIGHT"
},
{
"source_name": "Tick"
},
{
"source_name": "Trend Micro Daserf Nov 2017",
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"
},
{
"source_name": "Secureworks BRONZE BUTLER Oct 2017",
"url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
},
{
"source_name": "Trend Micro Tick November 2019",
"url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
},
{
"source_name": "Symantec Tick Apr 2016",
"url": "https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"
}
]
}Explicit source assertions (54)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03303147-db81-4cb3-9368-98ee4f963c1a
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05e9e12f-be5e-46f4-9f42-6f7fb7e9fb4a
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--069d3677-2694-4385-b5c3-ea6e231d26d9
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--089efdf8-b07a-4cda-aa5d-e60f9501ffd1
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--138fb337-c378-43a3-bacb-54f40696fb6b
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad674bb-c8e1-4f19-b96e-f56bfa10797c
Symantec Tick Apr 2016 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2174c465-8855-4c92-a683-97eb0eba9f7c
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28471736-5b62-4132-b4ed-c22ae449b455
Secureworks BRONZE BUTLER Oct 2017 · Symantec Tick Apr 2016 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d840d1b-28d7-4387-86fd-6d3df8650171
Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f2432b0-d985-41d8-bc47-e4aa1dbf8372
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--321a0d18-11a6-4504-add5-8ee515a43170
Symantec Tick Apr 2016ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0471
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c3579df-fbd4-4a68-8ee8-e45861a3eda0
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42897880-fe55-4f54-a42c-f85ba19fb39a
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c6aea43-27ba-4e6a-8907-e5db364a145b
Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--529360d5-172a-4326-b993-e3af75d3e7af
Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--545a618f-9fe4-4573-a0a0-ecfcef0b407c
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54e0e380-aef8-4c63-9792-ebda05affee6
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58fdc63b-05b4-4db9-90fe-c80f7956292f
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--595be2e7-9f2a-4d5a-b23d-8e4822ae6199
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6471e2c1-621f-4393-a63f-c6cfbacc592e
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c053469-7bd4-4b55-90b2-289a09aa53fa
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0469
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e122559-0e6e-4514-aa60-652e99292077
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--731d14c6-a141-4e71-ac61-c344636e13d5
Symantec Tick Apr 2016ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80fc5f0c-3dcb-45ab-807a-bfa3d64334c6
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--881b3ad2-38dd-45b0-b75b-49acf6f7c6a3
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f897f1c-7bc6-4a85-8d3b-627f976af215
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--935f9bb6-d38d-42d1-a764-6b5110ad5364
Symantec Tick Apr 2016 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95805281-96b1-49ea-95ee-9d654178c5c3
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99e9583f-433d-437d-bf37-7ea2b3f1b613
Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1053.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ef58dda-688d-4461-b5fc-25f2ba3a9c54
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0470
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8b5c1b4-9ccf-46bc-9074-59e866efcc83
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab66ef8a-f496-48d2-a358-0e4f7b00d5c0
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba7f4c8e-860a-45fc-a9e7-bb7d0ec96a2c
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf160f02-ab07-4f2d-8625-5818833bb77f
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c87a8320-8705-4de3-93ee-2db5c00ea461
Symantec Tick Apr 2016 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc13f316-0f88-4ed1-8790-b13bc35be119
Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d20b659b-3595-4171-9beb-668ab26bf398
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d36e83a0-5370-4d78-862d-4dbe8921709d
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d57dd9d9-d075-48c4-ae54-ed0aeae575de
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0111
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d691e305-8ce5-40cd-a648-b0dcab329e69
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7c5e4f4-cede-4a81-b46f-035b9e702e61
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb91c7d8-2cfb-4d8b-905a-d146bc8178e2
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0472
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebab1ba1-e02b-41ab-8682-5a44d68fb155
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec4d07a2-8c8b-4df8-bb9e-b8c3e23d8dc5
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0187
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f52f1b34-a96a-45a0-8cc0-2f138a3f1257
Trend Micro Daserf Nov 2017 · Symantec Tick Apr 2016ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5777849-9cea-4e02-93ba-9065b27f0e58
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6d23c6b-01c8-4bea-9bc6-2c66fbbbd3ae
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0596
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7a90a34-f9ad-45a9-abd2-22a4e27ebdfd
Recorded Future RedEcho Feb 2021ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa155ccc-b9db-48f6-bb1a-a367596668ad
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc4dd2b6-63a0-46fe-bfc4-90e58e5d1422
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc79f30d-94c8-400e-ab10-21d2a2527788
Secureworks BRONZE BUTLER Oct 2017 · Symantec Tick Apr 2016ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fda1acb3-8e87-4fff-ae19-7e6a2ff9d6c3
Secureworks BRONZE BUTLER Oct 2017 · Symantec Tick Apr 2016ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0473
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff5d1433-de7a-4aba-95c4-5d92782589f9
Trend Micro Tick November 2019ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1036.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff6fd36b-bc49-4df7-86f0-62b9d1fc9754
Trend Micro Tick November 2019