A Peek into BRONZE UNION’s Toolbox

Secureworks CTU analysis of BRONZE UNION (Emissary Panda/APT27) documents the group's continued evolution and use of both public and custom remote-access tooling (ZxShell, modified Gh0st RAT, SysUpdate), their persistence and privilege escalation techniques, C2 behaviours, and a large set of file, domain, and IP indicators observed in 2017–2018 that support detection and response.