RedNovember — APT Profile
RedNovember is a China-nexus cyber-espionage group tracked by Recorded Future's Insikt Group, which assesses it is highly likely state-sponsored. Insikt Group first reported the cluster in July 2024 as TAG-100 before renaming it RedNovember; Microsoft tracks overlapping activity as Storm-2077 and assesses that actor to be a China state threat actor active since at least January 2024. Its hallmark is high-tempo reconnaissance and likely compromise of internet-facing perimeter appliances - Ivanti Connect Secure, Cisco ASA, F5 BIG-IP, Palo Alto GlobalProtect, SonicWall, Sophos SSL VPN, Fortinet FortiGate, Citrix NetScaler and Outlook Web Access - pairing weaponised public proof-of-concept exploits with open-source post-exploitation tooling, chiefly the Go backdoor Pantegana, SparkRAT, the Go-based LESLIELOADER and Cobalt Strike. Insikt Group observed victims concentrated in aerospace and defence, government and professional services, with further targeting of space organisations, technology and semiconductor firms, law firms, news outlets and intergovernmental bodies across the Americas, Europe, Africa and Asia-Pacific.Also tracked as
TAG-100, Storm-2077
Vendor research
- Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON Microsoft Threat Intelligence
- TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies Recorded Future (Insikt Group)
- RedNovember Targets Government, Defense, and Technology Organizations Recorded Future (Insikt Group)
Countries linked to this actor
- Portugal targets
- South Africa targets