Bronze Starlight: Chinese Apt’s Short-Lived Ransomware For Cyberespionage

By Editor Last updated Mrz 4, 2025

This article examines the activities of Bronze Starlight, a Chinese Advanced Persistent Threat (APT) group that is suspected of engaging in cyberespionage and intellectual property theft. The group has been observed utilizing a malware loader called HUI Loader, which deploys various short-lived ransomware families including AtomSilo, LockFile, Night Sky, Pandora, and Rook. Unlike typical financially motivated ransomware operations, Bronze Starlight employs ransomware for tactical purposes such as destroying evidence, distracting investigators, and exfiltrating data. The group deploys Remote Access Trojans (RATs) such as PlugX, Cobalt Strike, and QuasarRAT through HUI Loader, and exhibits consistent use of a common command and control address as well as uploading HUI Loader samples from the same source. While the exact intentions behind the ransomware families used by Bronze Starlight are unclear, they may serve as a diversionary tactic for other malicious activities. The group gains initial access to networks through exploiting network perimeter weaknesses and utilizes Cobalt Strike Beacon for command and control functionalities. Notably, Bronze Starlight’s activities have received limited attention from the cybercrime community, highlighting their unique victimology.

Quickjump

Key Takeaways

BRONZE STARLIGHT, a Chinese APT group, is suspected of engaging in cyberespionage and intellectual property theft using short-lived ransomware families.
Both Bronze Riverside and Bronze Starlight deploy RATs through HUI Loader, with common C2 addresses and Virus Total uploads.
The tactical objectives of BRONZE STARLIGHT include destroying evidence, distracting investigators, and exfiltrating data, achieved through network perimeter weaknesses and the use of Cobalt Strike Beacon and HUI Loader.
The intention of the ransomware families used by BRONZE STARLIGHT is unclear, but they may serve as a ruse for other malicious activities beyond ransomware.

BRONZE STARLIGHT Overview

The PRE-EXISTING KNOWLEDGE provides an overview of BRONZE STARLIGHT’s use of short-lived ransomware families for cyberespionage activities. BRONZE STARLIGHT, a Chinese Advanced Persistent Threat (APT) group, has been identified as the perpetrator of cyberespionage and intellectual property theft. The group has been observed deploying ransomware such as AtomSilo, LockFile, Night Sky, Pandora, and Rook through their HUI Loader tool. These ransomware families exhibit short lifespans and are believed to be used as a means to distract investigators, destroy evidence, and exfiltrate data. The use of common Command and Control (C2) addresses and Virus Total uploads suggest a connection between the different ransomware strains used by BRONZE STARLIGHT. This activity raises concerns about the potential impact on the global cybersecurity landscape and highlights the role of state-sponsored hacking in cyber espionage activities.

Tactics and Techniques

Tactical objectives of the threat group include compromising networks through network perimeter weaknesses and utilizing Cobalt Strike Beacon for command and control functions. BRONZE STARLIGHT, a Chinese APT group, employs short-lived ransomware families for cyberespionage activities. The ransomware strains used, such as AtomSilo, LockFile, Night Sky, Pandora, and Rook, exhibit unique victimology and deviate from typical financially motivated operations. These ransomware families serve unclear intentions, potentially acting as a ruse for other malicious activities. The group’s objectives may involve destroying evidence, distracting investigators, and exfiltrating data. BRONZE STARLIGHT deploys RATs, including PlugX, Cobalt Strike, and QuasarRAT, through HUI Loader. They exploit network vulnerabilities and employ the HUI Loader for decryption, execution, and subsequent ransomware deployment and exfiltration. The group’s access to tools commonly used by Chinese state-backed hackers supports the belief that they engage in cyberespionage and intellectual property theft.

Common RAT Deployments

RAT deployments by the threat group involve the utilization of PlugX, Cobalt Strike, and QuasarRAT. These remote access trojans (RATs) are commonly deployed by the Chinese APT groups Bronze Riverside (APT41) and Bronze Starlight (APT10) through their use of HUI Loader. The RATs are often used for command and control functions, allowing the threat actors to maintain control over compromised networks. The deployment of these RATs supports the cyberespionage activities of the groups, enabling them to exfiltrate data, distract investigators, and destroy evidence. Additionally, the use of common C2 addresses among the different ransomware families used by these groups can impact attribution and detection efforts. This highlights the need for advanced techniques and tools to accurately attribute attacks and defend against them.

C2 Address and Uploads

C2 address and uploads play a crucial role in the attribution and detection efforts of cyber attacks. In the case of BRONZE STARLIGHT, the Chinese APT group known for their short-lived ransomware families, common C2 addresses and Virus Total uploads have been identified. The attacks carried out by the group, such as AtomSilo, Night Sky, and Pandora, share a common C2 address. Additionally, HUI Loader samples used by BRONZE STARLIGHT have been uploaded to Virus Total through the same source. These findings suggest a coordinated effort by the group in their cyber espionage activities. Furthermore, the use of ransomware by BRONZE STARLIGHT raises questions about its intention. It is possible that ransomware serves as a ruse for other malicious activities, similar to past observations. The ultimate goal of these ransomware families remains unclear, leaving room for potential additional malicious actions beyond ransomware.

Objectives of BRONZE STARLIGHT

The objectives of the threat group BRONZE STARLIGHT remain unclear, as their use of ransomware may serve as a cover for other malicious activities, leaving room for potential additional objectives beyond ransomware. Possible discussion ideas about the objectives of Bronze Starlight include the potential reasons for their use of short-lived ransomware families in their cyberespionage activities. One reason could be to destroy evidence and distract investigators by creating chaos and confusion within targeted networks. Ransomware can be an effective distraction technique, as it diverts attention and resources towards dealing with the ransomware incident, allowing the threat actors to carry out other malicious activities undetected. However, the use of ransomware also poses challenges for investigators, as decrypting encrypted files and identifying the true extent of the breach can be time-consuming and technically complex.

Unclear Ransomware Intention

The true intention behind the use of ransomware by BRONZE STARLIGHT remains unclear, leaving room for speculation about the potential ulterior motives and additional malicious activities that may be at play. Possible discussion ideas about the unclear intention of ransomware used by BRONZE STARLIGHT include:

Potential motives behind the use of ransomware by BRONZE STARLIGHT: The group’s use of ransomware may serve as a means to distract investigators and destroy evidence, as well as to exfiltrate sensitive data from compromised networks.
The role of ransomware as a diversion tactic for other malicious activities: It is possible that BRONZE STARLIGHT employs ransomware as a smokescreen to divert attention from other cyberespionage activities, such as network reconnaissance or data theft.
The potential for ransomware to serve as a cover for other malicious actions: The group may use ransomware as a ruse to disguise their true intentions, potentially masking more sophisticated attacks or intelligence-gathering operations.
Similar use of ransomware observed in the past: Previous instances of ransomware being used as a decoy or diversion tactic by other threat actors suggest that BRONZE STARLIGHT may be following a similar strategy.
Lack of clarity on the ultimate goal of these ransomware families: The true purpose of the ransomware used by BRONZE STARLIGHT remains uncertain, leaving open the possibility of additional malicious activities beyond simple extortion.

Follow us on Social Media

Engaging with our social media platforms allows individuals to stay up-to-date on the latest cybersecurity news, trends, and insights. Social media plays a crucial role in raising awareness about cybersecurity, as it provides a platform for professionals and enthusiasts to share valuable information and resources. By following us on platforms such as Linkedin, Twitter, and Facebook, users can access a wealth of knowledge and connect with the cybersecurity community. However, it is important to balance cybersecurity with privacy on social media platforms. Users should be cautious about the information they share and ensure that privacy settings are properly configured. Cybercriminals can exploit personal information shared on social media to launch targeted attacks. Therefore, it is essential to be mindful of the potential risks and take appropriate measures to protect oneself while engaging with social media platforms.

Tags for Content

Tags play a crucial role in categorizing and organizing content, improving visibility and reach, and enhancing user experience by providing relevant information and resources. In the context of the impact of ransomware on intellectual property theft and the evolving tactics of Chinese APT groups in cyberespionage activities, appropriate tags can help in easily retrieving and identifying related topics. By using relevant tags such as "ransomware," "cyberespionage," and "APT groups," users can quickly find content specifically related to these subjects. Additionally, tags like "intellectual property theft" and "Chinese APT groups" can further narrow down the search and provide targeted information. This ensures that users interested in understanding the evolving tactics of Chinese APT groups and the impact of ransomware on intellectual property theft can access valuable resources and insights easily, contributing to their mastery of the subject matter.

Frequently Asked Questions

How does the BRONZE STARLIGHT group compromise networks?

The Bronze Starlight group compromises networks through exploitation of network perimeter weaknesses. They deploy the HUI Loader for decryption and execution, followed by ransomware deployment and exfiltration using Cobalt Strike Beacon for command and control functions.

What are the common RATs deployed by the BRONZE STARLIGHT group?

The common rat types deployed by the Bronze Starlight group include PlugX, Cobalt Strike, and QuasarRAT. These remote access trojans are distributed through HUI Loader and used for command and control functions in their cyberespionage activities.

Are there any common patterns in the C2 addresses and Virus Total uploads associated with BRONZE STARLIGHT attacks?

There are common patterns in the C2 addresses and VirusTotal uploads associated with Bronze Starlight attacks. These patterns suggest a relationship between Bronze Starlight ransomware and cyberespionage, as the group targets a small number of victims and then abandons the projects.

What are the tactical objectives of BRONZE STARLIGHT when using ransomware?

The tactical objectives of BRONZE STARLIGHT when using ransomware include destroying evidence, distracting investigators, and exfiltrating data. They compromise networks through weaknesses in the network perimeter and utilize tools like Cobalt Strike Beacon and HUI Loader for command and control functions.

Is the intention behind the use of ransomware by BRONZE STARLIGHT clear, or could it serve as a cover for other malicious activities?

The intention behind the use of ransomware by BRONZE STARLIGHT remains unclear, leaving open the possibility that it serves as a cover for other malicious activities. This raises concerns about the potential impact of their attacks on critical infrastructure and the involvement of nation state actors in supporting or utilizing their cyberespionage operations.