# BRONZE VAPOR: threat group profile

> BRONZE VAPOR is a threat group thought to operate from China. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.precursorintelligence.com/threat-actors/bronze-vapor
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > BRONZE VAPOR

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 1 |
| Thought to operate from | China |
| Other names | 0 |
| Public reports | 1 |

## Who is BRONZE VAPOR?

BRONZE VAPOR is a threat group thought to operate from China. Public reporting about it is still limited.

### What public reporting says

> BRONZE VAPOR is a targeted threat group assessed with moderate confidence to be of Chinese origin. Artefacts from tools associated with this group and open source reporting on related incidents indicate that BRONZE VAPOR have operated since at least 2017.  The group conducts espionage against multiple industries including semiconductors, aviation and telecommunications.  CTU researchers assess BRONZE VAPOR's intent to be information theft, with operations focused on intellectual property (semiconductors) and personally identifiable information such as traveller records (aviation).  Compromise of telecommunications companies can yield personally identifiable information and meta data on client communications such as Call Data Records (CDR). Prior to 2019 their operational focus, with some exceptions, revolved around targets in East Asia particularity Taiwan with it's thriving semiconductor industry. In 2021 details emerged in open source of attacks on at least one European semiconductor company believed to date back to 2017.  In 2019 BRONZE VAPOR attacked one of more entities in the European airlines sector. The group gains initial access via VPN services, may use spearphishing with 'Letter of Appointment' themed lures, and deploys Cobalt Strike along with custom data exfiltration tools to target organizations.  Post-intrusion activity involves living-of-the-land using legitimate tools and commands available within victim environment as well as using AceHash for credential harvesting, WATERCYCLE for data exfiltration and STOCKPIPE for proxying information through Microsoft Exchange servers over email. BRONZE VAPOR uses a set of tactics that, although not individually unique, when viewed in aggregate create a relatively distinct playbook.  Intrusions begin with credential based attacks against an existing remote access solution (Citrix, VPN etc.) or B2B network access.  Cobalt Strike is deployed into the environment and further access is then conducted via Cobalt Strike Beacon and other features of the platform.  Sharphound is deployed to map out the victim's Active Directory infrastructure and and collect critical information about the domain including important account names.  Command and control infrastructure is hosted on subdomains of Azure and Appspot services to blend in with legitimate traffic. The threat actor also registers their own domains for command and control, often with a "sync" or "update" related theme. WinRAR is commonly used for compressing data prior to exfiltration.  Filenames for these archives often involve a string of numbers and variations of the word "update".  Data is exfiltrated using WATERCYCLE to cloud based platforms such as OneDrive and GoogleDrive.

## Who does BRONZE VAPOR go after?

**Sectors:** Semiconductor Industry

**Countries and victims named:** Taiwan

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about BRONZE VAPOR

- https://www.secureworks.com/research/threat-profiles/bronze-vapor

## Frequently asked questions

### Who is BRONZE VAPOR?

BRONZE VAPOR is a threat group thought to operate from China. Public reporting about it is still limited.

### Where is BRONZE VAPOR thought to be based?

Public reporting places BRONZE VAPOR as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does BRONZE VAPOR target?

In public reporting, sectors named include semiconductor industry, and 1 countries and victims are named, including Taiwan.

### How do I know if BRONZE VAPOR is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact