Tick — Threat Actors — SecurityStudies.info

Profile

Also known as: BRONZE BUTLER, G0060, Nian, PLA Unit 61419, REDBALDKNIGHT, STALKER PANDA, Stalker Taurus, Swirl Typhoon, TEMP.Tick, TICK CASTLE

Tick is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group appears to have close ties to the Chinese National University of Defense and Technology, which is possibly linked to the PLA. This threat actor targets organizations in the critical infrastructure, heavy industry, manufacturing, and international relations sectors for espionage purposes. The attacks appear to be centered on political, media, and engineering sectors. STALKER PANDA has been observed conducting targeted attacks against Japan, Taiwan, Hong Kong, and the United States.

ATT&CK techniques · 40

Resource Development

T1588.002Tool

Initial Access

T1189Drive-by Compromise T1566.001Spearphishing Attachment

Execution

T1053.002At T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1059.005Visual Basic T1059.006Python T1203Exploitation for Client Execution T1204.002Malicious File T1574.001DLL

Persistence

T1547.001Registry Run Keys / Startup Folder

Privilege Escalation

T1548.002Bypass User Account Control

Stealth

T1027.001Binary Padding T1027.003Steganography T1036Masquerading T1036.002Right-to-Left Override T1036.005Match Legitimate Resource Name or Location T1070.004File Deletion T1140Deobfuscate/Decode Files or Information

Defense Impairment

T1685Disable or Modify Tools

Credential Access

T1003.001LSASS Memory

Discovery

T1007System Service Discovery T1018Remote System Discovery T1083File and Directory Discovery T1087.002Domain Account T1124System Time Discovery T1518Software Discovery

Lateral Movement

T1080Taint Shared Content T1550.003Pass the Ticket

Collection

T1005Data from Local System T1039Data from Network Shared Drive T1113Screen Capture T1560.001Archive via Utility

Command and Control

T1071.001Web Protocols T1102.001Dead Drop Resolver T1105Ingress Tool Transfer T1132.001Standard Encoding T1573.001Symmetric Cryptography

Incidents attributed

No incident in the register is attributed to this actor.

In the news

Updated Cyber Threat Actor Naming System
Google Threat Intelligence · Jul 24, 2026

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential