Loading threat actor…
RedNovember is a Chinese state-sponsored cyberespionage group previously tracked as TAG-100, also rendered TAG100, whose activity overlaps with Microsoft's Storm-2077 cluster. RedNovember has been observed since at least mid-2024; the overlapping Storm-2077 activity dates to January 2024. Its operations support intelligence collection aligned with Chinese geopolitical and military interests. It targets government ministries, diplomatic entities, intergovernmental organizations, defense contractors, aerospace organizations, manufacturers, technology companies, telecommunications providers, financial institutions, law firms, and energy companies. Its global targeting includes the United States, Taiwan, South Korea, Panama, and Fiji, with additional operations across Europe, Asia, Africa, and the Americas. The group emphasizes reconnaissance and rapid exploitation of newly disclosed vulnerabilities in internet-facing VPN gateways, firewalls, and other perimeter appliances, frequently acting soon after public proof-of-concept exploits become available. Targeted products include Cisco ASA, F5 BIG-IP, Fortinet FortiGate, Ivanti Connect Secure, Palo Alto Networks GlobalProtect, SonicWall, Sophos, and Check Point gateways. It also targets Outlook Web Access, Zimbra, and 3CX environments. RedNovember uses Pantegana, Cobalt Strike, SparkRAT, and Go-based LESLIELOADER variants for command and control and post-exploitation. Its tooling supports cross-platform access, file transfer, system fingerprinting, and interactive command execution. Commercial VPN services and obfuscation support operational concealment, while compromised perimeter systems provide persistent access to sensitive networks. The overlapping Storm-2077 cluster uses phishing to steal credentials, harvests additional credentials from compromised endpoints, and accesses cloud email environments for intelligence collection. Observed email-theft techniques include abusing legitimate eDiscovery applications and creating applications with mail-read permissions after obtaining administrative access. RedNovember has conducted extensive reconnaissance against Panamanian government organizations and Taiwanese scientific research infrastructure, alongside targeting of US defense and aerospace entities. Its operations emphasize broad intelligence requirements and sustained access rather than ransomware or financially motivated extortion.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
5 malware families Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.