BRONZE EDGEWOOD

Executive Summary

BRONZE EDGEWOOD, also known as Red Hariasa, is assessed as a likely state-sponsored cyber threat group linked to China. The group has been active since at least 2018, primarily targeting government and private enterprises in Southeast Asia. BRONZE EDGEWOOD's activities include deploying webshells, leveraging Cobalt Strike, and using malware families such as Chinoxy, PCShare, and FunnyDream. Their operations are suspected to focus on political espionage.

Goals & Targeting

BRONZE EDGEWOOD's primary objectives appear to be political espionage, likely on behalf of the Chinese government. The group focuses on sectors where sensitive information is held, such as government agencies and private enterprises, particularly in Southeast Asia. This suggests a strategic intent to gather intelligence that could influence regional政治 dynamics.

BRONZE EDGEWOOD is a cyber threat group observed conducting malicious activities since at least 2018. The group has demonstrated a particular interest in targeting government and private sector entities across Southeast Asia. In early 2021, CTU researchers identified the group exploiting a Microsoft Exchange Server vulnerability, deploying China Chopper webshells, and utilizing the Nishang Invoke-PowerShellTcp.ps1 script for command-and-control (C2) communication. Additionally, BRONZE EDGEWOOD is known to incorporate Cobalt Strike into its toolkit, indicating a high level of operational sophistication. The group has been linked to malware families including Chinoxy, PCShare, and FunnyDream, which are often used in campaigns targeting financial institutions and government agencies for espionage purposes.

Key Capabilities

• Advanced persistent threat (APT) capabilities
• Exploitation of Microsoft Exchange vulnerabilities
• Webshell deployment (e.g., China Chopper)
• Use of Cobalt Strike for C2 communication
• Employment of Nishang scripts for remote command execution

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

BRONZE EDGEWOOD's campaigns often involve initial access through phishing or vulnerability exploitation, followed by the deployment of webshells and C2 scripts to establish persistence. The group demonstrates a patient operational tempo, focusing on long-term espionage rather than immediate damage. Notable operations include attacks against Southeast Asian government entities and financial institutions.

IOC Patterns

• Spear-phishing emails targeting specific organizations
• Webshell creation on compromised servers
• C2 communication via PowerShell scripts
• Use of known malware families (Chinoxy, PCShare, FunnyDream)

Recommended Actions

• Implement multi-factor authentication for Exchange Server access
• Monitor for unusual C2 activity using Process Monitor and network traffic analysis
• Deploy endpoint detection and response solutions to detect Cobalt Strike and related tools
• Conduct regular vulnerability assessments of email servers and web applications

Suggested Tags