Operation Redbonus

Operation Redbonus is a China-linked espionage activity cluster identified as one of several distinct users of the ShadowPad malware platform since 2017. It is tracked as a separate cluster alongside APT41, Tick & Tonto Team, Operation Redkanku, and Fishmonger, reflecting the broader ecosystem of operators using the privately sold ShadowPad backdoor. Operation Redbonus is associated with the use of ShadowPad, a modular backdoor and malware platform that emerged around 2015 as a successor to PlugX. ShadowPad is notable for its plugin-based architecture, in-memory loading of components, remote extensibility, and continued evolution with stronger anti-detection and persistence features. Its design supports staged loading through an obfuscated shellcode loader and a root component that decrypts and loads additional plugins, enabling flexible post-compromise capability expansion. Because ShadowPad is a commercially supplied platform rather than an openly shared framework, attribution of Operation Redbonus should be treated cautiously. Shared access to ShadowPad among multiple China-linked espionage clusters complicates efforts to distinguish operators based on malware alone. High-confidence assessment of Operation Redbonus therefore rests primarily on its identification as a distinct ShadowPad-using cluster within that broader ecosystem, rather than on uniquely documented victimology or tradecraft beyond ShadowPad use. Operation Redbonus is best understood as part of the wider landscape of China-linked intrusion activity that benefits from shared or privately sold malware tooling to reduce development costs and accelerate espionage operations.