BRONZE PRESIDENT

BRONZE PRESIDENT is a China-based cyberespionage group that has been active since at least 2018. CTU researchers assess with high confidence that the group operates from China and with moderate confidence that its activity is sponsored or tolerated by the Chinese government. The group targets governments, non-governmental organizations (NGOs) and other organizations of strategic interest around the world, including entities associated with China’s Belt and Road Initiative (BRI). Its operations appear focused on the collection of information of potential strategic or intelligence value, while establishing persistent access that can enable continued collection from compromised environments.

BRONZE PRESIDENT uses a combination of widely available offensive security tools and custom malware to gain access, move through networks, collect information and maintain persistence. Its operations have employed established tools such as Cobalt Strike, China Chopper and PlugX alongside malware associated more closely with the group, including RCSession, ORat, PUBLOAD, TONESHELL, CoolClient and FDMTP. The group has also demonstrated an emphasis on maintaining multiple access routes within compromised environments, increasing its ability to retain access and conduct prolonged intelligence collection even if individual tools or points of access are discovered and removed.