BRONZE BUTLER

Tick, also known as BRONZE BUTLER, RedBaldKnight, Stalker Panda, Stalker Taurus, Swirl Typhoon, and Tellurium, is a China-linked cyberespionage group with documented activity dating to at least 2006. It primarily targets organizations in Japan and South Korea to steal intellectual property and confidential information. Its targets include technology companies, engineering firms, and broadcasters. Operations have involved prolonged access to victim networks and theft of emails, technical documents, and presentations. Tick gains initial access through spearphishing with malicious Microsoft Word attachments, watering-hole attacks using compromised websites, and exploitation of internet-facing enterprise software. It exploited Microsoft Exchange ProxyLogon vulnerabilities before patches were released in 2021 and has exploited vulnerabilities in Trend Micro security products. Its malware portfolio includes the Gofarer downloader and custom backdoors such as Daserf, xxmm, and Datper. The group adopted ShadowPad, internally called Casper, as a primary backdoor beginning in 2018. Tick and Tonto Team have shared infrastructure and tools, although their names should not be treated as interchangeable aliases. Post-compromise activity includes command-shell execution, batch scripting, network enumeration with ping and Net, and credential dumping with Mimikatz, GSecdump, and Windows Credential Editor. Tick moves laterally through scheduled-task execution and by placing malware on network shares under names resembling legitimate documents. It disguises executables with document icons, downloads encoded payloads for decoding on compromised hosts, and has used stolen code-signing certificates. Collected information is staged in password-protected RAR archives before exfiltration. Observed intrusions have maintained access for as long as 18 months.