🇨🇳

BRONZE STARLIGHT

APT Group Information theft and espionage 3 zero-day CVEs ETDA ✓

Also Known As 4 names

Cinnamon Tempest DEV-0401 Emperor Dragonfly SLIME34

Target Countries 3

Countries highlighted in red

Philippines Singapore United States

Sectors Targeted

Data Processing, Hosting, and Related Services 51821 Casinos and Gambling Computer Systems Design and Related Services 54151

Details

Origin 🇨🇳 CN

Last Updated 23 Jul 2022

Malware Families 7

hui_loader

sorgu

unidentified_075

pandora_rat

Sliver Implant

NewCore

darkstrat

MITRE ATT&CK 32

T1021 T1021.002 T1027 T1036 T1047 T1059 T1059.001 T1059.003 T1059.006 T1071.001 T1078 T1078.002 T1080 T1090 T1102 T1105 T1140 T1190 T1484 T1484.001 T1543 T1543.003 T1566.001 T1567 T1567.002 T1569 T1572 T1574 T1574.001 T1588 T1588.002 T1657

Related Zero-Days 3

CVE-2021-40539 CVE-2021-44228 CVE-2024-0012

Known Names 6 entries

Bronze Starlight SecureWorks

DEV-0401 Microsoft

Cinnamon Tempest Microsoft

Operation ChattyGoblin SentinelLabs

SLIME34 ?

HighGround CrowdStrike

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

Philippines Southeast Asia

Description

(SecureWorks) BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group leverages HUI Loader to load Cobalt Strike and PlugX payloads for command and control. CTU researchers have observed BRONZE STARLIGHT deploying ransomware to compromised networks as part of name-and-shame ransomware schemes, and posted victim names to leak sites. CTU researchers assess with moderate confidence that BRONZE STARLIGHT is located in China based on observed tradecraft, including the use of HUI Loader and PlugX which are associated with China-based threat group activity. It is plausible that BRONZE STARLIGHT deploys ransomware as a smokescreen rather than for financial gain, with the underlying motivation of stealing intellectual property theft or conducting espionage.

Tools Used 8

AtomSilo Cobalt Strike HUI Loader LockFile NightSky Pandora PlugX Rook

Operations 1

2023-03 Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/

Reports & References 2

https://www.secureworks.com/research/threat-profiles/bronze-starlight https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader

ETDA Profile

Bronze Starlight

Origin

China

First Seen 2021

Motivation

Information theft and espionage

View on ETDA APT Groups ↗