.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
China
BRONZE BARTON
Summary
BRONZE BARTON has been active since at least 2021 and targets political organizations for intelligence-gathering purposes. CTU researchers assess with moderate confidence that they operate in alignment with PRC intelligence requirements. The group exploits vulnerable internet-facing servers to gain initial access and deploys a web shell for persistence.
BRONZE BARTON routes their command and control communications through a third-party proxy network that CTU researchers track as BRONZE COTTAGE. BRONZE BARTON is adept at moving between on-premises and cloud-based environments to access and exfiltrate data in support of their intelligence collection goals.
BRONZE BARTON routes their command and control communications through a third-party proxy network that CTU researchers track as BRONZE COTTAGE. BRONZE BARTON is adept at moving between on-premises and cloud-based environments to access and exfiltrate data in support of their intelligence collection goals.
Contact us
Contact us directly whether your organization needs immediate assistance or
you want to discuss your incident readiness, response, and testing needs.