Loading threat actor…
Red Menshen, also known as Earth Bluecrow, DecisiveArchitect, and Red Dev 18, is a China-based, state-linked advanced persistent threat group conducting cyberespionage. Active since at least 2021, it primarily targets telecommunications providers, with additional activity against government, logistics, education, financial services, retail, and defense organizations. Its operations span Asia, the Middle East, Africa, and Europe and emphasize maintaining covert, long-term access to critical communications infrastructure. The group's principal implant is BPFDoor, a passive backdoor associated with Linux and Solaris systems. It uses raw packet capture and Berkeley Packet Filter functionality to inspect incoming traffic for specially crafted activation packets, avoiding a conventional listening port or continuous command-and-control beaconing while dormant. Once activated, it provides bind or reverse shells. Its evasion techniques include process masquerading, execution from memory-backed storage, deletion of executable artifacts, timestomping, shell-history suppression, and temporary firewall traffic redirection. Newer variants conceal activation traffic within HTTPS requests delivered through TLS termination infrastructure, support SCTP inspection, and use ICMP-based communication between compromised hosts. Red Menshen obtains access through vulnerable internet-facing services and edge devices or compromised accounts, including privileged VPN credentials. Operators use internal BPFDoor controllers, webshells, and cross-platform frameworks to move from edge and management environments toward transport-network systems and mobile-core infrastructure, including Kubernetes-hosted workloads. Associated tools include ReGeorg, China Chopper, Mangzamel, Metasploit, CrossC2, Sliver, TinyShell, Mimikatz, PrintSpoofer, custom scanners, keyloggers, and brute-force utilities. Credential dumping, privilege escalation, lateral movement, and SCP-based data exfiltration have been observed. Investigated telecommunications intrusions extending into 2026 also demonstrate strategic pre-positioning without confirmed exfiltration in those particular environments. The group conceals operator access through compromised routers and other relay infrastructure; its operational schedules align with Chinese business hours and public holidays.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
11 malware families Mallory has associated with this actor across public reporting.
6 additional families tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
37 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.