Unmasking the True Motives Behind Ransomware: The Case of Bronze Starlight

Ransomware attacks have surged in recent years, causing significant financial and operational damage to organizations worldwide. However, not all ransomware campaigns are driven purely by financial gain. The case of the Chinese-based threat actor known as Bronze Starlight, or DEV-0401, reveals a more insidious use of ransomware—as a smokescreen for cyber espionage. 

The Emergence of Bronze Starlight

Bronze Starlight, active since early 2021, has gained notoriety for its sophisticated cyber attacks. Leveraging a custom DLL loader called HUI Loader, the group deploys Cobalt Strike and PlugX payloads to establish command and control over targeted systems. Over the past year, Bronze Starlight has utilized five ransomware families—LockFile, AtomSilo, Rook, Night Sky, and Pandora—and has exposed 21 victims on name-and-shame leak sites as of mid-April.

Ransomware as a Smokescreen

While ransomware typically aims to extort money from victims, Bronze Starlight’s campaigns appear to have a different end goal. According to cybersecurity researchers, the group uses ransomware to conceal its true objective: stealing intellectual property. This tactic serves to distract incident responders, focusing their efforts on recovery rather than investigating the underlying espionage activities.

Targeted Industries and Geographic Focus

Bronze Starlight’s victimology offers clues to its espionage motives. Researchers estimate that 75% of the known victims would be of interest to Chinese government-sponsored groups. The targets span various industries and geographic locations, including:

• Pharmaceutical companies in Brazil and the U.S.
• Electronic component designers and manufacturers in Lithuania and Japan
• U.S. law firms
• U.S.-based media organizations with offices in China and Hong Kong

Short-Lived Ransomware Campaigns

Unlike conventional financially motivated ransomware operations, Bronze Starlight’s ransomware families have brief lifespans. Each family targets a small number of victims over a short period before ceasing operations. This pattern, combined with the group’s focus on exploiting known vulnerabilities in network perimeter devices, underscores the strategic and selective nature of their attacks.

Code Overlap and Unique Strains

Bronze Starlight has developed distinct ransomware strains. LockFile and AtomSilo share a codebase, while Rook, Night Sky, and Pandora are based on the Babuk ransomware source code, leaked in September 2021. These ransomware families are unique to Bronze Starlight and exhibit significant similarities in their campaigns, including the use of the HUI loader to deploy Cobalt Strike beacons.

Collaboration Among Chinese-Based Threat Actors

Evidence suggests that Bronze Starlight collaborates with other Chinese-based threat actors. For instance, in a January incident response, researchers observed Bronze University, another Chinese threat group, active on the same network as Bronze Starlight. This collaboration points to a broader strategy of resource and information sharing among Chinese espionage attackers, further blurring the lines between financially motivated and state-sponsored cyber activities.

Implications for Cybersecurity

The operations of Bronze Starlight highlight the evolving complexity of ransomware attacks. Organizations must recognize that ransomware can serve multiple purposes beyond extortion, including acting as a cover for espionage. To mitigate such threats, businesses should:

• Implement robust cybersecurity measures: Regularly update and patch systems to protect against known vulnerabilities.
• Enhance incident response protocols: Focus not only on recovery but also on investigating potential espionage activities.
• Invest in threat intelligence: Stay informed about emerging threats and threat actor tactics to better anticipate and defend against attacks.

Bronze Starlight’s use of ransomware as a smokescreen for espionage underscores the multifaceted nature of modern cyber threats. By understanding the broader motives behind these attacks, we can better protect our organizations from both financial and intellectual property losses.

Alvaka is available 24×7 to assist you with any of your cybersecurity needs. Fill out the form on this page or call us at (949)428-5000!