Bronze President, also known as RedDelta and Mustang Panda, has shifted its focus from Asia to Russia as the conflict in Ukraine continues. The group has been active since at least 2018 and conducts cyberespionage, seeking to gather intelligence from NGOs, research institutes, and internet server providers. The group is believed to be based out of China, either sponsored or tolerated by the Chinese government. Secureworks Counter threat Unit found that the group changed its targeting methods in response to the current political climate, leading some to believe that they are not state-sponsored.
Bronze President’s campaigns over the last several years have focused primarily on Southeast Asia, and targets were chosen for political and economic reasons. The group conducts data theft and ongoing surveillance once they breach a network. However, the group has since shifted gears to target Russian-speaking entities. In addition, this could reflect the changing intelligence collection requirements of China, according to researchers. The change in targets could be at the request of the Chinese government.
Read More: Bronze President spies on Russian targets as Ukraine invasion continues
