Red Foxtrot

Red Foxtrot is a China-linked threat actor cluster publicly reported by Recorded Future and linked in a 2021 report to the Chinese People’s Liberation Army (PLA) Unit 69010. In the provided reporting, Cisco Talos states that UAT-7290 shares significant overlap with Red Foxtrot in victimology, infrastructure, and tooling, and that victimology and infrastructure also overlap with Red Foxtrot. The surrounding activity is described as espionage-focused intrusions against critical infrastructure, primarily telecommunications providers in South Asia, with more recent expansion into Southeastern Europe. Observed tactics and tooling in the overlapping activity include extensive pre-intrusion reconnaissance, exploitation of one-day vulnerabilities in public-facing edge networking devices, target-specific SSH brute force, use of Linux-focused malware including RushDrop, DriveSwitch, SilentRaid, and Bulbature, and establishment of Operational Relay Box infrastructure. Based on the provided content, Red Foxtrot is associated with China/PLA-linked espionage activity; however, the detailed TTPs and malware above are described in the context of overlap with UAT-7290 rather than being directly and independently attributed to Red Foxtrot in the source material. Known alias in the provided content: red_foxtrot.