{
  "id": "bronze-butler",
  "name": "BRONZE BUTLER",
  "aliases": [
    "REDBALDKNIGHT",
    "Tick"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Likely Chinese origin",
      "src": [
        "mitre-g0060"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2008,
      "src": [
        "mitre-g0060"
      ],
      "conf": "medium",
      "note": "At least 2008"
    },
    {
      "k": "attack_id",
      "v": "G0060",
      "src": [
        "mitre-g0060"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.",
      "src": [
        "mitre-g0060"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 40,
      "src": [
        "mitre-g0060"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ABK, at, Avenger, BBK, build_downer, cmd, Daserf, down_new, gsecdump, Mimikatz, Net, schtasks, ShadowPad, Windows Credential Editor",
      "src": [
        "mitre-g0060"
      ],
      "conf": "high",
      "note": "14 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0060)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/bronze-butler.html",
  "sources": {
    "mitre-g0060": {
      "title": "BRONZE BUTLER, Group G0060",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0060/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}