BRONZE BUTLER
G00601 reportsaliases · BRONZE BUTLER · REDBALDKNIGHT · Tick
1
Reports
12
Techniques
9
Tactics
2
Countries
25%
Hunt coverage
3
Aliases
Analyst assessment — key judgments
- Signature techniques: T1053.005 (Scheduled Task), T1113 (Screen Capture), T1583.007 (Serverless).
- Primary targeting: BR, US.
- Currently dormant: 0 report(s) in last 30d vs 0 prior (+0%).
- Hunt coverage 25% of 48 observed techniques (36 gap(s)).
- Assessment confidence: medium (60).
Activity & trend
DormantLast 30d: 0 vs 0 prior (+0%)· first reported 2026-05-07 · last 2026-05-07
0
7d
0
30d
1
90d
1
All
0.1
Rpts/wk
Reporting timeline · 12 months
Overview
Analyst triage
Intelligence summary
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
Top co-occurring indicators
Aliases & naming
Targeting · countries
Targeting · named victims
ATT&CK technique matrix
Coverage vs hunt library:
—
Hunt-coverage gaps — prioritized
Top techniques by observation
- T1053.005 · Scheduled Taskconf 601
- T1113 · Screen Captureconf 601
- T1583.007 · Serverlessconf 601
- T1027.009 · Embedded Payloadsconf 601
- T1059.007 · JavaScriptconf 601
- T1114 · Email Collectionconf 601
- T1114.001 · Local Email Collectionconf 601
- T1497.001 · System Checksconf 601
- T1566.001 · Spearphishing Attachmentconf 601
- T1115 · Clipboard Dataconf 601
- T1082 · System Information Discoveryconf 601
- T1071 · Application Layer Protocolconf 601
Threat catalogue · engineering roadmap
Flagged detection-engineering queue
Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.
Infrastructure
IOC type mix
Tooling / malware families
Relationships
Activity
30-day mention timeline
Recent reporting
| Title | Source | Severity | Collected |
|---|