Chinese hacker group BRONZE UNION targeted various range of organizations with a range of capabilities with a variety of tools and flexible tactics.
The BRONZE UNION group targets a variety of organizations that includes political, technology, manufacturing, and humanitarian organizations.
According to SecureWorks analysts, the group is active since 2013 and it continues to expand its capabilities by adding a number of tools to its arsenal. The hacker group stealing data about cutting-edge weapons technologies to spying on dissidents and other civilian groups.
Analysis of Bronze Union’s network reveals that the group uses services, tools, and credentials native to the compromised environment.
Threat actors obtain access to networks and maintain access for a long period and they return to the infrastructure every three months to verify the existence of a web shell and to refresh the connection.
The hacker group uses publically available tools to lower the detection rate, in the mid of 2018 the group uses an updated version of ZxShell RAT and Gh0st RAT to compromise multiple system and to escalate privileges.
Along with publically available tools they customized malware such as HyperBro and SysUpdate since 2016. SysUpdate is a multi-stage malware that exclusively used by BRONZE UNION group.
Threat actors use a number of methods to deploy the malware on victim’s machine such as through malicious Word document using DDE embedded method, manual deployment by gaining access to the environment with stolen credentials and the next method is through self-extracting WinRAR archive.
“The threat actors use stolen credentials to remotely access business email accounts and search for specific keywords and individuals in significant roles. BRONZE UNION has also used email access to download email attachments and data and log into victims’ instant messenger services”, reads SecureWorks report.
Researchers recommend organization within the interest of BRONZE UNION’s to implement security controls and risk management strategies that defend against the hacker group tactics.
Two Hacker Groups Stolen $1 Billion by Compromising the Crypto Exchanges
Leader of the Hacker Group Jailed for Stealing $15 Million from Russian Banks
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…