BRONZE SPIRAL

Executive Summary

BRONZE SPIRAL is an unidentified threat actor believed with low confidence to be of Chinese origin. The group targeted SolarWinds through a vulnerability in their Orion Platform, deploying a web shell named SUPERNOVA. BRONZE SPIRAL's activities include long-term access to victim networks for credential harvesting and data exfiltration, likely focusing on espionage or intellectual property theft.

Goals & Targeting

BRONZE SPIRAL's strategic objectives appear to focus on espionage or theft of intellectual property, likely targeting sectors with significant technological or sensitive information, such as government entities, defense contractors, and telecommunications companies. The group's observed behavior suggests they prioritize high-value victims that provide access to valuable data or infrastructure. Their operational focus on IT management software providers like SolarWinds and ManageEngine indicates a sector-specific targeting approach.

BRONZE SPIRAL emerged into public view following the December 2020 SolarWinds attack. The threat group exploited a vulnerability (CVE-2020-10148) in SolarWinds' Orion Platform to deploy SUPERNOVA, a web shell. CTU researchers observed pre-deployment reconnaissance activity, suggesting the actors conducted targeted scanning and triaging of victims before full deployment. In addition to SolarWinds, BRONZE SPIRAL has been linked to intrusions involving ManageEngine servers. The group is known for maintaining persistent access to victim networks over extended periods, periodically harvesting credentials, and exfiltrating sensitive data. Their primary activities appear to align with espionage or intellectual property theft objectives. BRONZE SPIRAL's operational tactics include extensive use of native system tools and 'living off the land' techniques, making their activity difficult to detect. The group's ability to maintain long-term access and adapt their methods underscores a level of technical proficiency.

Key Capabilities

• Web shell deployment
• 'Living off the land' techniques
• Credential dumping
• Lateral movement within networks
• Data exfiltration
• Long-term persistence

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

BRONZE SPIRAL's campaign patterns suggest a focus on targeted attacks with long-term operational persistence. Known campaigns include the December 2020 SolarWinds attack and intrusions involving ManageEngine servers. The group demonstrates patient hunting behavior, scanning for high-value targets before deploying SUPERNOVA and establishing persistence. Notable operations involve credential dumping, lateral movement, and prolonged data exfiltration efforts.

IOC Patterns

• Exploitation attempts targeting CVE-2020-10148
• Web shell activity indicative of SUPERNOVA deployment
• Unusual system administrator account activity
• Registry modifications related to credential dumping
• Scheduled task creation for persistence

Recommended Actions

• Patch all known vulnerabilities in SolarWinds Orion Platform and other IT management software.
• Monitor for unusual activity indicative of web shell deployments or 'living off the land' tactics.
• Implement multi-factor authentication for high-value accounts to mitigate credential dumping risks.
• Conduct regular network traffic analysis to detect data exfiltration activities.
• Enhance logging and monitoring of system administrator tools and their usage patterns.

Suggested Tags