Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · BRONZE STARLIGHT · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

BRONZE STARLIGHT

  • SLIME34
  • DEV-0401
  • Cinnamon Tempest
  • Emperor Dragonfly

MITRE G1021 ↗

BRONZE STARLIGHT — ATT&CK roseBS

attack rose · 19 techniques across 10 tactics

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2021-26084, CVE-2021-34473, CVE-2021-36942, CVE-2021-44228, CVE-2022-26134

Analyst brief

misp-galaxy + mitre-attack

BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group leverages HUI Loader to load Cobalt Strike and PlugX payloads for command and control. CTU researchers have observed BRONZE STARLIGHT deploying ransomware to compromised networks as part of name-and-shame ransomware schemes, and posted victim names to leak sites.

CTU researchers assess with moderate confidence that BRONZE STARLIGHT is located in China based on observed tradecraft, including the use of HUI Loader and PlugX which are associated with China-based threat group activity. It is plausible that BRONZE STARLIGHT deploys ransomware as a smokescreen rather than for financial gain, with the underlying motivation of stealing intellectual property theft or conducting espionage.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

19 techniques · 10 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    1 technique

  3. Execution

    4 techniques

  4. Persistence

    1 technique

  5. Stealth

    4 techniques

  6. Defense impairment

    1 technique

  7. Lateral movement

    2 techniques

  8. Command and control

    3 techniques

  9. Exfiltration

    1 technique

  10. Impact

    1 technique

select a technique

Arsenal

5 malware · 3 tools
Malware
Malware · 5ATT&CK
PandoraS0664 ↗
PlugXS0013 ↗
CheerscryptS1096 ↗
Cobalt StrikeS0154 ↗
HUI LoaderS1097 ↗
Tools
Tools · 3ATT&CK
SliverS0633 ↗
ImpacketS0357 ↗
RcloneS1040 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs BRONZE STARLIGHT is cited as exploiting

none on KEV
  1. CVE-2021-344732026-10-17
    1. “SLIME34 ProxyShell (CVE-2021-34473)”

      cited as exploiting · source: i.blackhat.com ↗ · 2026-10-17

    2. “DEV-0401 has previously deployed multiple ransomware families including LockFile, AtomSilo, and Rook, and has similarly exploited Internet-facing systems running Confluence (CVE-2021-26084) and on-premises Exchange servers (CVE-2021-34473).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  2. CVE-2021-369422026-10-17
    1. “SLIME34 ProxyShell (CVE-2021-34473) Lateral movement (PetitPotam CVE-2021-36942)”

      cited as exploiting · source: i.blackhat.com ↗ · 2026-10-17

  3. CVE-2021-442282026-10-17
    1. “In February of 2022, DEV-0401 was observed deploying the Pandora ransomware family, primarily via unpatched VMware Horizon systems vulnerable to the Log4j 2 CVE-2021-44228 vulnerability .”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “We have observed a China-based ransomware operator that we’re tracking as DEV-0401 exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell ) targeting internet-facing systems running VMWare Horizon.”

      cited as exploiting · source: twitter.com ↗ · 2026-10-17

    3. “In February of 2022, DEV-0401 was observed deploying the Pandora ransomware family, primarily via unpatched VMware Horizon systems vulnerable to the Log4j 2 CVE-2021-44228 vulnerability .”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    4. “As early as January 4, attackers started exploiting the CVE-2021-44228 vulnerability in internet-facing systems running VMware Horizon. Our investigation shows that successful intrusions in these campaigns led to the deployment of the NightSky ransomware.”

      cited as exploiting · named nearby · source: microsoft.com ↗ · 2026-10-17

  4. CVE-2022-261342026-10-17
    1. “Multiple adversaries and nation-state actors, including DEV-0401 and DEV-0234, are taking advantage of the Atlassian Confluence RCE vulnerability CVE-2022-26134.”

      cited as exploiting · source: twitter.com ↗ · 2026-10-17

  5. CVE-2021-260842026-10-17
    1. “DEV-0401 has previously deployed multiple ransomware families including LockFile, AtomSilo, and Rook, and has similarly exploited Internet-facing systems running Confluence (CVE-2021-26084) and on-premises Exchange servers (CVE-2021-34473).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

14 sources
  1. 1.i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Lo…
  2. 2.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-under…
  3. 3.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detec…
  4. 4.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beaco…
  5. 5.twitter.com/cglyer/status/1480734487000453121
  6. 6.blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group
  7. 7.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-g…
  8. 8.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service…
  9. 9.secureworks.com/research/bronze-starlight-ransomware-operations-use-hu…
  10. 10.attack.mitre.org/groups/G1021
  11. +4 more in the JSON record

Track BRONZE STARLIGHT on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.