BRONZE ELGIN

BRONZE ELGIN has targeted government and military organizations in Southeast Asia since 2015. CTU researchers assess with moderate confidence that it operates on behalf of China. The threat group has often used the Elise backdoor in its operations. Between June and December 2025, BRONZE ELGIN compromised the hosting infrastructure of popular editing tool Notepad++. The threat actors used this access to selectively target users in El Salvador, Australia, Vietnam and the Philippines with malicious Notepad++ update files that installed Chrysalis malware. The group also deployed meterpreter shellcodes and Cobalt Strike to support their operations.