ChinaAssessedChina-basedEspionageActive 2008 – 2025BRONZE BUTLER
Also known asTick · REDBALDKNIGHT · Swirl Typhoon · TELLURIUM · Stalker Panda
Summary
Long-running espionage group (MITRE G0060; Microsoft: Swirl Typhoon; Trend Micro: Tick / REDBALDKNIGHT) of likely Chinese origin, active since at least 2008 and focused on Japanese organisations in government, defence, aerospace, satellite communications, electronics manufacturing and industrial chemistry. Its tradecraft includes watering holes on compromised Japanese websites and Office exploits (CVE-2014-4114, CVE-2018-0802, CVE-2018-0798) for initial access (T1189, T1203), payloads concealed by steganography and right-to-left-override filenames (T1027.003, T1036.002), malware planted on file shares under legitimate document names (T1080), forged Kerberos tickets for persistent administrative access (T1550.003) and DLL side-loading (T1574.001), with Daserf and the ABK / BBK downloaders. In Operation ENDTRADE, which Trend Micro watched from late 2018 into 2019, it zeroed in on specific Japanese industries to steal proprietary and classified data. In mid-2025, Sophos found it exploiting Motex LANSCOPE Endpoint Manager CVE-2025-61932 as a zero-day to deploy the Gokcpdoor proxy backdoor, months before the October 2025 patch.
Attribution
MITRE: likely Chinese origins; no service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-07)
Likely Chinese origins - Microsoft (Research, 2026-10)
Tracked as Swirl Typhoon, origin China
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Motex LANSCOPE Endpoint Manager CVE-2025-61932 zero-day — Gokcpdoor deployment | 2025 | Undisclosed | Undisclosed | Sophos CTU (2025-10) — zero-day exploitation of CVE-2025-61932 observed mid-2025, Gokcpdoor and Havoc; victims undisclosed (the page refuses this workspace's browser and was read through WebFetch) |
| Operation ENDTRADE — multi-stage backdoors against Japanese defence, aerospace, satellite-communications and chemical firms | 2018 – 2019 | Japan | Defense, Aerospace, Satellite, Chemical | Trend Micro (2019-11) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access1 | T1189Drive-by Compromise |
|---|---|
| Execution1 | T1203Exploitation for Client Execution |
| Stealth3 | T1027.003SteganographyT1036.002Right-to-Left OverrideT1574.001DLL |
| Lateral Movement2 | T1080Taint Shared ContentT1550.003Pass the Ticket |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| Daserf | Backdoor | Windows |
| ABK | Downloader | Windows |
| BBK | Downloader | Windows |
| Gokcpdoor | Proxy backdoor | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-61932 | 9.8 | Motex LANSCOPE Endpoint Manager — improper verification of communication source, 0-day (KEV 2025-10-22) |
| CVE-2018-0798 | 8.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
| CVE-2014-4114 | 7.8 | Windows OLE "Sandworm" — RCE via PowerPoint (KEV 2022-03-03) |
| CVE-2018-0802 | 7.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Watering holes on compromised Japanese websites (MITRE ATT&CK, 2026)
- Gokcpdoor proxies to hard-coded C2 on TCP 443; file.io, LimeWire and Piping Server for exfiltration (Sophos CTU, 2025)