Tick
aka BRONZE BUTLER, REDBALDKNIGHT
A Chinese espionage group that mainly targets Japanese organizations. In 2025 it broke in through an unknown flaw in LANSCOPE, a Japanese IT asset management product, to steal data.
- Alert level
- 4/ 5
- Reports & advisories (90 days)
- 11
- Known exploited CVEs
- 1
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed as Chinese state-sponsored — Sophos
- Describes it as a cyber espionage group with likely Chinese origins — MITRE ATT&CK
Exploited vulnerabilities and targeted products
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Exploiting in-house management software
Like abusing a faulty master key carried by the building manager who checks every room.
Inside
Hiding behind relays
Like passing a letter through several go-betweens so nobody knows who sent it.
Inside
Copying the company directory
Like quietly copying the staff list and floor plan at reception to pick the next target.
Goal
Smuggling data out via file-sharing sites
Like stashing stolen papers in a public storage locker to collect later.
Recent articles
- virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
- 「skyticket」で確認された3つの不正アクセスについてまとめてみた
- nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
- CyrusOne: 373,460 件のアカウント情報が流出
- Medela: 423,947 件のアカウント情報が流出
- Agents on Rails: Maximum effort and DeepSeek 4.1 Flash
- Dutch PHP Conference 2027
- PHPBenelux Conference 2027, Antwerp Belgium
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily