🇨🇳

BRONZE SPIRAL

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇨🇳 CN

Last Updated 23 Jul 2022

MITRE ATT&CK 28

T1003.001 T1021 T1021.002 T1047 T1059 T1059.001 T1059.003 T1059.006 T1071.001 T1078 T1078.002 T1080 T1090 T1105 T1140 T1190 T1484 T1484.001 T1543 T1543.003 T1567 T1567.002 T1572 T1574 T1574.001 T1588 T1588.002 T1657

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 6 entries

Bronze Starlight SecureWorks

DEV-0401 Microsoft

Cinnamon Tempest Microsoft

Operation ChattyGoblin SentinelLabs

SLIME34 ?

HighGround CrowdStrike

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

Philippines Southeast Asia

Description

(SecureWorks) BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group leverages HUI Loader to load Cobalt Strike and PlugX payloads for command and control. CTU researchers have observed BRONZE STARLIGHT deploying ransomware to compromised networks as part of name-and-shame ransomware schemes, and posted victim names to leak sites. CTU researchers assess with moderate confidence that BRONZE STARLIGHT is located in China based on observed tradecraft, including the use of HUI Loader and PlugX which are associated with China-based threat group activity. It is plausible that BRONZE STARLIGHT deploys ransomware as a smokescreen rather than for financial gain, with the underlying motivation of stealing intellectual property theft or conducting espionage.

Tools Used 8

AtomSilo Cobalt Strike HUI Loader LockFile NightSky Pandora PlugX Rook

Operations 1

2023-03 Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/

Reports & References 2

https://www.secureworks.com/research/threat-profiles/bronze-starlight https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader

ETDA Profile

Bronze Starlight

Origin

China

First Seen 2021

Motivation

Information theft and espionage

View on ETDA APT Groups ↗