Loading threat actor…
RedFoxtrot, also known as Nomad Panda, is a Chinese state-sponsored cyber-espionage threat actor assessed to be linked to the People’s Liberation Army, specifically PLA Unit 69010 in Ürümqi, Xinjiang, and associated with the PLA Strategic Support Force. The group has been active since at least 2014 and has primarily targeted government, telecommunications, aerospace and defense, mining, and research organizations across Central and South Asia, with a pronounced focus on India during periods of heightened China-India tensions. Reported victim countries include Afghanistan, India, Kazakhstan, Kyrgyzstan, Pakistan, Tajikistan, and Uzbekistan. RedFoxtrot is known for sustained espionage operations aligned with Chinese strategic and geopolitical interests. Its operations have included targeting Indian state-owned enterprises involved in nuclear, space, and defense work, as well as telecommunications providers and government agencies across the region. Activity associated with the group has also overlapped with campaigns tracked by other vendors under names including Temp.Trident, and some reporting notes partial overlaps with clusters such as Moshen Dragon and tactical or infrastructure similarities with other China-linked actors. The actor has used a mix of bespoke and widely shared China-nexus malware and intrusion tooling, including PlugX, ShadowPad, PCShare, Poison Ivy variants, IceFog, and Royal Road-delivered lures. A notable PlugX variant associated with RedFoxtrot, dubbed Talisman, uses DLL sideloading chains built from legitimate signed executables, malicious loader DLLs, and encrypted payloads. This malware supports modular plug-ins, persistence through scheduled tasks, services, or autoruns, privilege adjustment, and process injection. RedFoxtrot has also been linked to campaigns using ShadowPad and to infrastructure overlaps involving PCShare. Reporting further indicates access to commercially developed malware within the broader Chinese contractor ecosystem, including ShadowPad. Operationally, RedFoxtrot has demonstrated strong use of defense evasion and post-compromise tradecraft. Observed techniques include DLL sideloading, process injection, modular backdoors, scheduled-task and service-based persistence, and the use of Dynamic DNS and VPS-hosted command-and-control infrastructure that is rotated in bulk. The group has also been associated with reconnaissance and targeting patterns consistent with long-term intelligence collection. In related overlapping activity, operators linked by some vendors to RedFoxtrot or Nomad Panda have abused legitimate security software for DLL search-order hijacking and used credential-harvesting components and lateral movement tooling, though such overlap should be treated cautiously where attribution is not definitive. RedFoxtrot is best characterized as a PLA-linked espionage actor focused on regional strategic intelligence collection, especially against states bordering China and sectors relevant to defense, communications, government decision-making, and scientific or industrial development.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
51 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Suspected PLA-linked unit identified as a recipient of the commercially sold ShadowPad backdoor.
Attributed with medium confidence as the operator of the Talisman PlugX campaign targeting telecommunications and defense organizations in South Asia, using PlugX/PCShare-linked infrastructure and DLL sideloading-based backdoor deployment.
Referenced as a China-linked adversary with tactical and infrastructure overlaps with UAT-7290.
China/PLA-linked cyber-espionage group associated with long-running (since ~2014) intelligence collection campaigns, primarily targeting aerospace/defense and other strategic sectors in neighboring countries.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.