BRONZE VINEWOOD

BRONZE VINEWOOD is a China-nexus espionage group that has targeted government, legal, consulting, telecommunications, software development, and technology organizations worldwide. CTU research suggests that organizations operating within government, defense, critical infrastructure, and associated supply chains are at increased risk from BRONZE VINEWOOD. In 2024, the UK National Cyber Security Centre (NCSC) publicly attributed reconnaissance activity against UK parliamentarians to APT31, while the United States announced sanctions and criminal indictments against individuals and infrastructure associated with the group's cyber operations. In 2026, the group was identified as an early adopter of the BlueMoon exploit framework, a capability that chained multiple Chrome and Windows vulnerabilities to achieve remote code execution and privilege escalation on targeted systems.

BRONZE VINEWOOD has employed a broad range of intrusion techniques for initial access, persistence, credential theft, and lateral movement, including SQL injection, spear-phishing, exploitation of public-facing applications, Trochilus RAT, HanaRat, and custom malware. The group has also demonstrated the ability to rapidly operationalize newly disclosed vulnerabilities and exploit capabilities, often using Cloud-based services as staging for stolen data.