BRONZE SPRING is a threat group that CTU researchers assess with high confidence operates on behalf of China in the theft of intellectual property from defense, engineering, pharmaceutical and technology companies. The threat group typically uses scan-and-exploit for initial access, deploys the China Chopper webshell for remote execution and persistence, and creates RAR archives with a '.jpg' file extension for data exfiltration. In July 2020 the U.S. Department of Justice indicted two Chinese hackers CTU researchers assess are members of the BRONZE SPRING threat group. The Department of Justice allege these hackers were responsible for compromising networks of hundreds of organisations and individuals in the U.S. and abroad since 2009, and that exfiltrated data would be passed to the Chinese Ministry of State Security or sold for financial gain.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | UNC302 |
Sectors: Information technology, Medical, Civil engineering, Business, Education, Gaming, Energy, Pharmaceuticals, Defense industrial base
Victim countries: United States, Australia, Belgium, Germany, Japan, Lithuania, Netherlands, Spain, South Korea, Sweden, United Kingdom
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names BRONZE SPRING, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to BRONZE SPRING. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.