Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Tick · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

Tick

  • Nian
  • BRONZE BUTLER
  • REDBALDKNIGHT
  • STALKER PANDA
  • G0060
  • Stalker Taurus
  • PLA Unit 61419
  • Swirl Typhoon

state sponsor · ChinaMITRE G0060 ↗

Tick — ATT&CK roseTI

attack rose · 40 techniques across 12 tactics

What changed

ledger · newest first
  1. —todaynew CVE6 new CVEs: CVE-2011-0611, CVE-2014-4114, CVE-2014-6332, CVE-2016-7836, CVE-2018-0798, CVE-2018-0802
  2. —1 mo agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

Tick is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group appears to have close ties to the Chinese National University of Defense and Technology, which is possibly linked to the PLA. This threat actor targets organizations in the critical infrastructure, heavy industry, manufacturing, and international relations sectors for espionage purposes.

The attacks appear to be centered on political, media, and engineering sectors. STALKER PANDA has been observed conducting targeted attacks against Japan, Taiwan, Hong Kong, and the United States.

Observed targets (as stated by the sources)

4 countries · 8 sectors
JapanChinaSouth KoreaRussiaAssessed origin: China

assessed origin · Chinaobserved targets · 4

countries · 4

  • Japan
  • China
  • South Korea
  • Russia

sectors · 8

  • Private sector
  • Infrastructure
  • Industrial
  • Manufacturing
  • Diplomacy
  • News - Media
  • Political party
  • Engineering

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

40 techniques · 12 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    2 techniques

  3. Execution

    8 techniques

  4. Persistence

    1 technique

  5. Privilege escalation

    1 technique

  6. Stealth

    8 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    1 technique

  9. Discovery

    6 techniques

  10. Lateral movement

    2 techniques

  11. Collection

    4 techniques

  12. Command and control

    5 techniques

select a technique

Arsenal

7 malware · 7 tools
Malware
Malware · 7ATT&CK
build_downerS0471 ↗
ABKS0469 ↗
BBKS0470 ↗
down_newS0472 ↗
DaserfS0187 ↗
ShadowPadS0596 ↗
AvengerS0473 ↗
Tools
Tools · 7ATT&CK
MimikatzS0002 ↗
cmdS0106 ↗
atS0110 ↗
schtasksS0111 ↗
NetS0039 ↗
Windows Credential EditorS0005 ↗
gsecdumpS0008 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Tick is cited as exploiting

none on KEV
  1. CVE-2011-06112026-10-17
    1. “Stalker Panda has been observed attaching malicious documents (.PDF) to their email spears leveraging CVE-2011-0611 (Adobe Flash, Reader, and Acrobat vulnerability).”

      cited as exploiting · source: wikileaks.org ↗ · 2026-10-17

  2. CVE-2014-63322026-10-17
    1. “cases, the victims were social engineered into browsing to a compromised website that leveraged CVE-2014-6332 (Windows OLE vulnerability).”

      cited as exploiting · named nearby · source: wikileaks.org ↗ · 2026-10-17

  3. CVE-2016-78362026-10-17
    1. “It has several methods for infecting its targets of interest: spear phishing emails, watering hole attacks, and exploiting a remote code execution vulnerability ( CVE-2016-7836 , patched last March 2017) in SKYSEA Client View, an IT asset management software widely used in Japan.”

      cited as exploiting · named nearby · source: blog.trendmicro.com ↗ · 2026-10-17

    2. “It has several methods for infecting its targets of interest: spear phishing emails, watering hole attacks, and exploiting a remote code execution vulnerability ( CVE-2016-7836 , patched last March 2017) in SKYSEA Client View, an IT asset management software widely used in Japan.”

      cited as exploiting · named nearby · source: blog.trendmicro.com ↗ · 2026-10-17

  4. CVE-2018-07982026-10-17
    1. “BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2018-08022026-10-17
    1. “BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2014-41142026-10-17
    1. “BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2017Bronze ButlerDell Secureworks ↗

Take it with you

keyless · no signup

References

17 sources
  1. 1.wikileaks.org/vault7/document/2015-08-20150814-256-CSIR-15005-Stalke…
  2. 2.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan
  3. 3.secureworks.jp/resources/rp-bronze-butler
  4. 4.researchcenter.paloaltonetworks.com/2017/07/unit42-tick-group-continues-attacks
  5. 5.blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html
  6. 6.cfr.org/interactive/cyber-operations/bronze-butler
  7. 7.secureworks.com/research/bronze-butler-targets-japanese-businesses
  8. 8.blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-b…
  9. 9.attack.mitre.org/groups/G0060
  10. 10.secureworks.com/research/threat-profiles/bronze-butler
  11. +7 more in the JSON record

Track Tick on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.