BRONZE WOODLAND

BRONZE WOODLAND, active since June 2014, has been observed leveraging phishing lures with Mandarin Chinese language artifacts and deploying the PlugX RAT. It has historically targeted entities in Russia and members of the Commonwealth of Independent States (CIS), specifically Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, Ukraine and Uzbekistan. CTU researchers assess with moderate confidence that BRONZE WOODLAND operates on behalf of China.