Bronze Starlight
Description
(SecureWorks) BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group leverages HUI Loader to load Cobalt Strike and PlugX payloads for command and control. CTU researchers have observed BRONZE STARLIGHT deploying ransomware to compromised networks as part of name-and-shame ransomware schemes, and posted victim names to leak sites.
CTU researchers assess with moderate confidence that BRONZE STARLIGHT is located in China based on observed tradecraft, including the use of HUI Loader and PlugX which are associated with China-based threat group activity. It is plausible that BRONZE STARLIGHT deploys ransomware as a smokescreen rather than for financial gain, with the underlying motivation of stealing intellectual property theft or conducting espionage.
Names
| Name | Name-Giver |
|---|---|
| Bronze Starlight | SecureWorks |
| DEV-0401 | Microsoft |
| Cinnamon Tempest | Microsoft |
| Operation ChattyGoblin | SentinelLabs |
| SLIME34 | ? |
| HighGround | CrowdStrike |
Country
Motivation
- Information theft and espionage
First Seen
2021
Observed Sectors
Observed Countries
Tools
Operations
- 2023-03: Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Information
- https://www.secureworks.com/research/threat-profiles/bronze-starlight
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader
Other Information
Uuid
ada0ccd1-3229-4514-9a65-a66dd7ec862b
Last Card Change
2025-06-28