Loading story…
RedNovember, a Chinese state-sponsored threat actor also tracked as Storm-2077, has conducted a widespread cyber espionage campaign targeting government and private sector organizations across multiple continents. The group leveraged publicly available proof-of-concept exploits for vulnerabilities in perimeter appliances from vendors such as Check Point, Cisco, Citrix, F5, Fortinet, Ivanti, Palo Alto Networks, and SonicWall to gain initial access. RedNovember deployed the Go-based backdoor Pantegana and Cobalt Strike during its intrusions, compromising entities including ministries, defense contractors, and intergovernmental organizations. Security researchers highlight the group's rapid adoption of newly disclosed vulnerabilities and its alignment with Chinese state interests, emphasizing the risks posed by the public release of exploit code.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In September 2025, Recorded Future assessed the actor previously tracked as TAG100 as highly likely Chinese state-sponsored and began tracking it as RedNovember. The report also linked the group to malware infrastructure overlapping with Google Mandiant-tracked UNC5266 and detailed its use of LeslieLoader, SparkRAT, Pantegana, and Cobalt Strike.
By July 2025, the campaign had affected organizations across the Americas, Asia, Africa, Europe, and Oceania, including at least two U.S. defense contractors, a European government directorate, and entities in aerospace, legal, energy, and government sectors. Reporting says the activity ran from June 2024 through July 2025 and relied on compromised VPNs, firewalls, and other edge devices.
In April 2025, RedNovember targeted 30 Panamanian organizations during a visit by U.S. Defense Secretary Pete Hegseth. The targeting was cited as another example of the group's operations tracking sensitive geopolitical developments.
The group was detected conducting activity in December 2024 during a surprise Chinese military exercise around Taiwan, indicating operations aligned with geopolitical events. Reporting describes this as reconnaissance or intrusion activity tied to Taiwan-related intelligence collection.
Recorded Future's Insikt Group first observed the threat actor later renamed RedNovember in July 2024. Early activity showed compromises of internet-facing edge devices and targeting of exposed collaboration and email systems for persistent access.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcethecyberthrone.in
Open sourcego.theregister.com
Open sourcebankinfosecurity.com
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese state-linked intrusion groups have continued broad cyberespionage operations against governments, critical infrastructure, telecommunications, finance, technology, and research organizations across Europe, Southeast Asia, Russia, the United States, and other regions. Public reporting from ENISA/CERT-EU, CISA, and private threat intelligence firms links multiple campaigns to clusters including **APT27**, **APT30**, **APT31**, **GALLIUM**, **Mustang Panda**, **APT41/RedGolf**, **TA459**, and **RedHotel**, with activity focused on information theft, persistent access, and in some cases economic espionage. Authorities and researchers said these actors repeatedly exploited exposed enterprise systems such as Microsoft Exchange, SharePoint, Zimbra, Pulse Connect Secure, Citrix ADC, F5 BIG-IP, VMware vCenter, Atlassian Confluence, and ManageEngine, while also using spear-phishing, EU-themed lures, and spoofed domains to gain entry.
Aug 15, 2026
Trend Micro and TrendAI reported that China-aligned espionage groups collaborated by passing live access to already-compromised networks between intrusion sets, a model Trend calls **"Premier Pass-as-a-Service."** In one cited case, **Earth Estries** breached a Southeast Asian government environment, deployed **CrowDoor** and related tooling, and then enabled follow-on activity tied to **Earth Naga**—also tracked as **Flax Typhoon**, **RedJuliett**, or **Ethereal Panda**—including **ShadowPad** infrastructure. The reporting says this approach differs from traditional initial access brokerage because downstream operators appear to receive direct access to victim assets rather than just stolen credentials or footholds. The activity aligns with separate reporting that **RedJuliett** intensified cyber espionage against Taiwanese organizations through exploitation of internet-facing network perimeter devices, while Trend Micro described **Earth Estries** as conducting long-term intrusions across government, telecommunications, and information service providers in APAC, Taiwan, and NATO countries. Researchers said the cooperative model can place multiple China-linked actors in the same intrusion chain or even the same process flow, complicating attribution and incident response, and they highlighted exploitation of **Citrix** devices including `CVE-2025-5777` among the techniques used to gain or extend access.
Aug 21, 2026
A China-linked cyber-espionage group, tracked as UNC5221, has been systematically targeting network and infrastructure appliances that lack traditional endpoint detection and response (EDR) capabilities. The group has deployed a sophisticated backdoor, known as 'Brickstorm,' to enable persistent, long-term access to compromised environments. According to Google’s Threat Intelligence Group (GTIG), the campaign has affected organizations across various sectors, including legal services, technology, software-as-a-service (SaaS) providers, and business process outsourcing. The attackers have exploited the lack of EDR support on edge devices, making detection and remediation particularly challenging. Brickstorm is designed to evade detection by mimicking legitimate software and using unique command-and-control (C2) servers for each victim, which complicates efforts to block or track the malware. The average dwell time for the attackers within victim networks has been reported as 393 days, indicating a high level of stealth and operational security. During this time, UNC5221 has been observed accessing sensitive emails belonging to developers, administrators, and other individuals of strategic interest, often by abusing Microsoft Entra ID enterprise applications with elevated permissions. The campaign has also resulted in the compromise of SaaS providers, which in turn has led to downstream access to their customers’ environments, amplifying the potential impact. The attackers have targeted leading network appliances from vendors such as SonicWall, Cisco, and Palo Alto Networks, highlighting the breadth of the campaign. GTIG reports that the threat actors have used their access to steal proprietary source code and other intellectual property related to enterprise technologies, which may be analyzed to discover new vulnerabilities for future exploitation. The campaign’s focus on long-term, undetected access distinguishes it from other Chinese-linked espionage operations, such as RedNovember, which prioritizes speed and scale over stealth. Security experts note that the strategic aim of these campaigns is to gain intelligence and maintain persistent access to high-value targets globally. The use of unique C2 infrastructure for each victim further complicates incident response and attribution. The campaign’s ability to remain undetected for over a year in some environments underscores the need for improved monitoring and security controls on edge devices and network appliances. The targeting of organizations with access to downstream customers raises concerns about supply chain risks and the potential for widespread secondary compromise. Researchers emphasize that the attackers’ analysis of stolen source code could lead to the discovery of zero-day vulnerabilities, increasing the threat to enterprise technology products worldwide. The campaign demonstrates the evolving tactics of Chinese APT groups in targeting critical infrastructure and enterprise technologies. Organizations are urged to review their security posture, particularly regarding edge devices and third-party service providers, to mitigate the risk of similar intrusions. The incident highlights the importance of cross-sector collaboration and intelligence sharing to detect and respond to sophisticated, long-term cyber-espionage campaigns.
Jun 29, 2026