BRONZE PRESIDENT

BRONZE PRESIDENT has been active since at least July 2018, and probably much longer. CTU researchers assess with high confidence that the group is based in China, and with moderate confidence that it is sponsored by or at least tolerated by the Chinese government. The group has used proprietary and publicly available tools to compromise and collect data from governments and non-governmental organizations (NGOs) around the world, creating multiple contingent access routes to maintain long-term access to compromised systems. The group also target organizations that may be connected to Belt and Road (BRI) investment projects. BRONZE PRESIDENT uses common malware such as Cobalt Strike, China Chopper and PlugX, as well as several tools that appear to be exclusive to the group, including; RCSession, ORat, PUBLOAD, TONESHELL, CoolClient and the FDMTP Backdoor.