BRONZE BUTLER
BRONZE BUTLER, also known as Tick, REDBALDKNIGHT, Stalker Panda, Stalker Taurus, Swirl Typhoon, and Tellurium, is a Chinese state-linked threat actor. The content also references TA428 in connection with Tmanger and shared tooling such as the Royal Road RTF Weaponizer, but does not establish with high confidence that TA428 is an alias of BRONZE BUTLER, so it should be treated as related reporting rather than a confirmed alias. The actor has used spearphishing emails with malicious Microsoft Word attachments to induce user execution. Reported execution methods include batch scripts, command-line execution, and PowerShell. BRONZE BUTLER has downloaded encoded payloads and decoded them on victim systems, and several of its tools have used Base64 when posting data to command-and-control servers. Its malware has used HTTP for command and control. Observed discovery and credential-access-related behavior includes use of net user /domain to identify account information. The actor has collected file listings from victims, uploaded those listings to command-and-control infrastructure, and then generated lists of specific files to steal. It has exfiltrated files from local systems and deleted RAR archives after exfiltration. For persistence and lateral movement, BRONZE BUTLER has used batch scripts to add Registry Run keys and has used schtasks to register scheduled tasks to execute malware during lateral movement. It has also disguised malware by giving it the same name as an existing file on a file share server so users would unwittingly launch it on additional systems. The actor has used open-source tools including Mimikatz, gsecdump, and Windows Credential Editor. It has also incorporated code into several tools to terminate antivirus processes. Separate referenced reporting states that the Daserf backdoor used by REDBALDKNIGHT/BRONZE BUTLER employed steganography. The content also states that Tick exploited Microsoft Exchange ProxyLogon vulnerabilities, compromising the web server of an East Asia-based IT services company, and that ESET assessed Tick likely had access to an exploit before patches were released.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Military
- Government & Administration
- Software & Services
Where they target
Geographies tied to known operations.
- 🇰🇷 South Korea
- 🇯🇵 Japan
Tradecraft
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
21 malware families attributed to this actor across reporting.
16 additional families tracked in Mallory.
Associated vulnerabilities
11 CVEs this actor has used in observed campaigns. 11 of them exploited in the wild.
The exploitation of a recently disclosed critical security flaw in Motex Lanscope Endpoint Manager has been attributed to a cyber espionage group known as Tick. The vulnerability, tracked as CVE-2025-61932 (CVSS score: 9.3), allows remote attackers to execute arbitrary commands with SYSTEM privileges... confirmed reports of active abuse of the security defect to drop a backdoor on compromised systems.
...exploited Microsoft vulnerabilities, including CVE-2014-4114...
BITTER has exploited Microsoft Office vulnerabilities... CVE-2018-0798...
...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.
Our latest report into Tick’s activity found it exploiting the ProxyLogon vulnerability to compromise a South Korean IT company, as one of the groups with access to that remote code execution exploit before the vulnerability was publicly disclosed.
6 more CVEs tied to this actor tracked in Mallory.
Observables
13 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.