Chinese Hacker Group Targets Range of Organizations With Variety of Tools and Tactics

Chinese hacker group BRONZE UNION targeted various range of organizations with a range of capabilities with a variety of tools and flexible tactics.

The BRONZE UNION group targets a variety of organizations that includes political, technology, manufacturing, and humanitarian organizations.

According to SecureWorks analysts, the group is active since 2013 and it continues to expand its capabilities by adding a number of tools to its arsenal. The hacker group stealing data about cutting-edge weapons technologies to spying on dissidents and other civilian groups.

Analysis of Bronze Union’s network reveals that the group uses services, tools, and credentials native to the compromised environment.

Threat actors obtain access to networks and maintain access for a long period and they return to the infrastructure every three months to verify the existence of a web shell and to refresh the connection.

The hacker group uses publically available tools to lower the detection rate, in the mid of 2018 the group uses an updated version of ZxShell RAT and Gh0st RAT to compromise multiple system and to escalate privileges.

Along with publically available tools they customized malware such as HyperBro and SysUpdate since 2016. SysUpdate is a multi-stage malware that exclusively used by BRONZE UNION group.

Threat actors use a number of methods to deploy the malware on victim’s machine such as through malicious Word document using DDE embedded method, manual deployment by gaining access to the environment with stolen credentials and the next method is through self-extracting WinRAR archive.

“The threat actors use stolen credentials to remotely access business email accounts and search for specific keywords and individuals in significant roles. BRONZE UNION has also used email access to download email attachments and data and log into victims’ instant messenger services”, reads SecureWorks report.

Researchers recommend organization within the interest of BRONZE UNION’s to implement security controls and risk management strategies that defend against the hacker group tactics.

Related Read

Two Hacker Groups Stolen $1 Billion by Compromising the Crypto Exchanges

Leader of the Hacker Group Jailed for Stealing $15 Million from Russian Banks

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

PAN-OS Command Injection Flaw Lets Hackers Execute Arbitrary Code Remotely

Palo Alto Networks has disclosed a medium-severity vulnerability (CVE-2025-0127) in its PAN-OS software, enabling authenticated…

10 minutes ago

Researchers Uncover Hacking Tools and Techniques Shared on Russian-Speaking Cybercrime Forums

Trend Micro, a cybersecurity firm, has released its 50th installment report on the Russian-speaking cybercriminal…

10 hours ago

SideCopy APT Hackers Impersonate Government Officials to Deploy Open-Source XenoRAT Tool

The Pakistan-linked Advanced Persistent Threat (APT) group known as SideCopy has significantly expanded its targeting…

11 hours ago

Russian APT Hackers Use Device Code Phishing Technique to Bypass MFA

Russian state-backed advanced persistent threat (APT) group Storm-2372 has exploited device code phishing to bypass…

12 hours ago

Threat Actors Exploit Messaging Services as Lucrative Cybercrime Platforms

Threat actors are exploiting weaknesses in SMS verification systems to generate massive, fraudulent message traffic,…

12 hours ago

Scattered Spider Launches Sophisticated Attacks to Steal Login Credentials and MFA Tokens

The cyber threat landscape has witnessed remarkable adaptation from the notorious hacker collective known as…

12 hours ago