Skip to Content
China icon
China

BRONZE HOBART

ObjectivesEspionage, Surveillance
AliasesAPT23, Earth Centaur (Trend Micro), KeyBoy (CitizenLab), Pirate Panda (CrowdStrike), Red Orthrus (PWC), TA413 (Proofpoint), Tropic Trooper (Trend Micro)
ToolsCrowdoor, DSNGInstaller, KeyBoy, LOWZERO, Mofu, Pfine, Sepulcher, Xiangoop Loader, Yahaoyah

Summary

BRONZE HOBART has actively targeted Tibetan activists and supporters using weaponized RTF documents that installed a PowerShell RAT dubbed 'Pfine'. There are infrastructure and targeting overlaps between BRONZE HOBART and public reporting on KeyBoy, TropicTrooper and Pirate Panda. CTU researchers assess with moderate confidence that BRONZE HOBART operates on behalf of China.
Threat Bottom Section BG

Contact us

Contact us directly whether your organization needs immediate assistance or
you want to discuss your incident readiness, response, and testing needs.