Chinese hacker group BRONZE UNION targeted various range of organizations with a range of capabilities with a variety of tools and flexible tactics.

The BRONZE UNION group targets a variety of organizations that includes political, technology, manufacturing, and humanitarian organizations.

According to SecureWorks analysts, the group is active since 2013 and it continues to expand its capabilities by adding a number of tools to its arsenal. The hacker group stealing data about cutting-edge weapons technologies to spying on dissidents and other civilian groups.

Analysis of Bronze Union’s network reveals that the group uses services, tools, and credentials native to the compromised environment.

Threat actors obtain access to networks and maintain access for a long period and they return to the infrastructure every three months to verify the existence of a web shell and to refresh the connection.

The hacker group uses publically available tools to lower the detection rate, in the mid of 2018 the group uses an updated version of ZxShell RAT and Gh0st RAT to compromise multiple system and to escalate privileges.

Along with publically available tools they customized malware such as HyperBro and SysUpdate since 2016. SysUpdate is a multi-stage malware that exclusively used by BRONZE UNION group.

Threat actors use a number of methods to deploy the malware on victim’s machine such as through malicious Word document using DDE embedded method, manual deployment by gaining access to the environment with stolen credentials and the next method is through self-extracting WinRAR archive.

“The threat actors use stolen credentials to remotely access business email accounts and search for specific keywords and individuals in significant roles. BRONZE UNION has also used email access to download email attachments and data and log into victims’ instant messenger services”, reads SecureWorks report.

Researchers recommend organization within the interest of BRONZE UNION’s to implement security controls and risk management strategies that defend against the hacker group tactics.

Related Read

Two Hacker Groups Stolen $1 Billion by Compromising the Crypto Exchanges

Leader of the Hacker Group Jailed for Stealing $15 Million from Russian Banks