Tracking Tick Through Recent Campaigns Targeting East Asia
Summary: Cisco Talos reports that a threat group tracked as Tick, Redbaldknight and Bronze Butler has run cyberattacks against South Korea and Japan since 2016, using custom tools and hijacked command and control domains. A Datper variant written in Delphi and submitted to VirusTotal in late July 2018 used a legitimate but unencrypted Korean laundry website, whitepia[.]co.kr, as its C2 host, and shared C2 infrastructure and IPs with the xxmm backdoor and Emdivi malware families.
Bottom line: The actor has a documented history of finding and penetrating vulnerable websites in South Korea and Japan to host C2, and one IP, 211[.]13[.]196[.]164, served both Datper and Emdivi, tying the campaigns to the Blue termite actor. A single unpatched, unencrypted website in your region can become someone else's command channel.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026