Chinese hacker group BRONZE UNION targeted various range of organizations with a range of capabilities with a variety of tools and flexible tactics.
The BRONZE UNION group targets a variety of organizations that includes political, technology, manufacturing, and humanitarian organizations.
According to SecureWorks analysts, the group is active since 2013 and it continues to expand its capabilities by adding a number of tools to its arsenal. The hacker group stealing data about cutting-edge weapons technologies to spying on dissidents and other civilian groups.
Analysis of Bronze Union’s network reveals that the group uses services, tools, and credentials native to the compromised environment.
Threat actors obtain access to networks and maintain access for a long period and they return to the infrastructure every three months to verify the existence of a web shell and to refresh the connection.
The hacker group uses publically available tools to lower the detection rate, in the mid of 2018 the group uses an updated version of ZxShell RAT and Gh0st RAT to compromise multiple system and to escalate privileges.
Along with publically available tools they customized malware such as HyperBro and SysUpdate since 2016. SysUpdate is a multi-stage malware that exclusively used by BRONZE UNION group.
Threat actors use a number of methods to deploy the malware on victim’s machine such as through malicious Word document using DDE embedded method, manual deployment by gaining access to the environment with stolen credentials and the next method is through self-extracting WinRAR archive.
“The threat actors use stolen credentials to remotely access business email accounts and search for specific keywords and individuals in significant roles. BRONZE UNION has also used email access to download email attachments and data and log into victims’ instant messenger services”, reads SecureWorks report.
Researchers recommend organization within the interest of BRONZE UNION’s to implement security controls and risk management strategies that defend against the hacker group tactics.
Two Hacker Groups Stolen $1 Billion by Compromising the Crypto Exchanges
Leader of the Hacker Group Jailed for Stealing $15 Million from Russian Banks
In the ever-evolving cybersecurity landscape, Google is continually striving to protect user data from malicious actors. In a recent blog…
In a startling revelation, nearly 20% of Docker Hub repositories have been identified as conduits for malware and phishing scams,…
Kubernetes (K8s) is an open-source container orchestration platform designed to automate application container deployment, scaling, and running. Containers are isolated…
Microsoft's Azure platform is a highly acclaimed and widely recognized solution that organizations worldwide are leveraging. It is regarded as…
The first instance of Redline using such a method is in a new variant of Redline Stealer malware that McAfee…
A threat actor reportedly sells a database containing 49 million user records from Dell, one of the world's leading technology…