Threat actor · all actors
BRONZE BUTLERG0060 state
🇨🇳 CN
aka BRONZE BUTLER, REDBALDKNIGHT, Tick, Nian, STALKER PANDA, G0060, Stalker Taurus, PLA Unit 61419, Swirl Typhoon, TEMP.Tick, TICK CASTLE
Last updated: 2026-08-20
About this actor
[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
Microsoftweather-system names
CrowdStrikenation-animal names
MandiantTEMP temporary cluster
Secureworkscolour-metal names
Palo Alto Unit 42constellation names
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 58 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
T1003OS Credential Dumping ↗T1003.001LSASS Memory ↗T1005Data from Local System ↗T1007System Service Discovery ↗T1018Remote System Discovery ↗T1027Obfuscated Files or Information ↗T1027.001Binary Padding ↗T1027.003Steganography ↗T1036Masquerading ↗T1036.002Right-to-Left Override ↗T1036.005Match Legitimate Resource Name or Location ↗T1039Data from Network Shared Drive ↗T1053Scheduled Task/Job ↗T1053.002At ↗T1053.005Scheduled Task ↗T1059Command and Scripting Interpreter ↗T1059.001PowerShell ↗T1059.003Windows Command Shell ↗T1059.005Visual Basic ↗T1059.006Python ↗T1070Indicator Removal ↗T1070.004File Deletion ↗T1071Application Layer Protocol ↗T1071.001Web Protocols ↗T1080Taint Shared Content ↗T1083File and Directory Discovery ↗T1087Account Discovery ↗T1087.002Domain Account ↗T1102Web Service ↗T1102.001Dead Drop Resolver ↗T1105Ingress Tool Transfer ↗T1113Screen Capture ↗T1124System Time Discovery ↗T1132Data Encoding ↗T1132.001Standard Encoding ↗T1140Deobfuscate/Decode Files or Information ↗T1189Drive-by Compromise ↗T1203Exploitation for Client Execution ↗T1204User Execution ↗T1204.002Malicious File ↗T1518Software Discovery ↗T1547Boot or Logon Autostart Execution ↗T1547.001Registry Run Keys / Startup Folder ↗T1548Abuse Elevation Control Mechanism ↗T1548.002Bypass User Account Control ↗T1550Use Alternate Authentication Material ↗T1550.003Pass the Ticket ↗T1560Archive Collected Data ↗T1560.001Archive via Utility ↗T1566Phishing ↗T1566.001Spearphishing Attachment ↗T1573Encrypted Channel ↗T1573.001Symmetric Cryptography ↗T1574Hijack Execution Flow ↗T1574.001DLL ↗T1588Obtain Capabilities ↗T1588.002Tool ↗T1685Disable or Modify Tools ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 41 / 58 | 71% |
CM-2 | 37 / 58 | 64% |
CM-6 | 37 / 58 | 64% |
SI-3 | 34 / 58 | 59% |
CA-7 | 27 / 58 | 47% |
CM-7 | 26 / 58 | 45% |
AC-3 | 22 / 58 | 38% |
AC-6 | 22 / 58 | 38% |
AC-2 | 21 / 58 | 36% |
SI-7 | 19 / 58 | 33% |
AC-4 | 18 / 58 | 31% |
SC-7 | 18 / 58 | 31% |
SI-2 | 16 / 58 | 28% |
AC-5 | 14 / 58 | 24% |
CM-5 | 14 / 58 | 24% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- Patchwork 0.41
- MuddyWater 0.39
- RedCurl 0.39
- APT33 0.33
- APT39 0.33
Same nation-state
- Night Dragon 1.00
- FunnyDream 1.00
- Operation Wocao 1.00
- C0017 1.00
- Cutting Edge 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00