Chinese Hacker Group Targets Range of Organizations With Variety of Tools and Tactics

Chinese hacker group BRONZE UNION targeted various range of organizations with a range of capabilities with a variety of tools and flexible tactics.

The BRONZE UNION group targets a variety of organizations that includes political, technology, manufacturing, and humanitarian organizations.

According to SecureWorks analysts, the group is active since 2013 and it continues to expand its capabilities by adding a number of tools to its arsenal. The hacker group stealing data about cutting-edge weapons technologies to spying on dissidents and other civilian groups.

Analysis of Bronze Union’s network reveals that the group uses services, tools, and credentials native to the compromised environment.

Threat actors obtain access to networks and maintain access for a long period and they return to the infrastructure every three months to verify the existence of a web shell and to refresh the connection.

The hacker group uses publically available tools to lower the detection rate, in the mid of 2018 the group uses an updated version of ZxShell RAT and Gh0st RAT to compromise multiple system and to escalate privileges.

Along with publically available tools they customized malware such as HyperBro and SysUpdate since 2016. SysUpdate is a multi-stage malware that exclusively used by BRONZE UNION group.

Threat actors use a number of methods to deploy the malware on victim’s machine such as through malicious Word document using DDE embedded method, manual deployment by gaining access to the environment with stolen credentials and the next method is through self-extracting WinRAR archive.

“The threat actors use stolen credentials to remotely access business email accounts and search for specific keywords and individuals in significant roles. BRONZE UNION has also used email access to download email attachments and data and log into victims’ instant messenger services”, reads SecureWorks report.

Researchers recommend organization within the interest of BRONZE UNION’s to implement security controls and risk management strategies that defend against the hacker group tactics.

Related Read

Two Hacker Groups Stolen $1 Billion by Compromising the Crypto Exchanges

Leader of the Hacker Group Jailed for Stealing $15 Million from Russian Banks

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…

21 hours ago

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…

22 hours ago

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…

22 hours ago

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…

22 hours ago

RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge

The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…

22 hours ago

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

1 day ago