Tracking Tick Through Recent Campaigns Targeting East Asia

Cisco Talos documents a long-running espionage campaign attributed to Tick/Redbaldknight/Bronze Butler against East Asia (Japan and South Korea) since 2016, detailing the use of compromised websites as C2 for malware families such as Datper, xxmm backdoor, and Emdivi, and identifying shared infrastructure and indicators (domains, IPs, mutexes, and PDB paths) that connect campaigns across 2017 and 2018 and suggest potential watering-hole or drive-by delivery methods.