Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain
Between July 2023 and December 2024, RedDelta, a Chinese state-sponsored group, targeted Mongolia, Taiwan, and Southeast Asia using advanced spearphishing campaigns with evolving infection chains and the PlugX backdoor.
Chinese Threat Actors Targeting Europe in SmugX Campaign - Check Point Research
Introduction In the last couple of months, Check Point Research (CPR) has been tracking the activity of a Chinese threat actor targeting Foreign Affairs ministries and embassies in Europe. Combined with other Chinese activity previously reported by Check Point Research, this represents a larger trend within the Chinese ecosystem, pointing to a shift to targeting […]
New research from Insikt Group has observed activity attributed to likely Chinese state-sponsored threat activity group
#RedDelta using a customized variant of the
#PlugX backdoor (heavily customized for anti-analysis for detection evasion). More in the report:
https://www.recordedfuture.com/reddelta-targets-european-government-organizations-continues-iterate-custom-plugx-variant
RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant | Recorded Future
Insikt Group® examines operations conducted by likely Chinese state-sponsored threat activity group RedDelta targeting organizations across Asia and Europe.
#RedDelta / #MustangPanda have expanded to using ISO files in addition to RAR and ZIP files.
Also, the config decryption key changed to jOh752oCI for their more recent variants of #plugx.
https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf
Hackers Continue Cyberattacks Against Vatican, Catholic Orgs
The China-linked threat group RedDelta has continued to launch cyberattacks against Catholic institutions since May 2020 until as recently as last week.
Китайские хакеры атаковали компьютерные системы Ватикана
Атаки произошли в преддверии перезаключения предварительного соглашения с Пекином о назначении епископов.
The Threat Codex
avallach
Julian-Ferdinand Vögele
ITSEC News
SecurityLab