Sep 24, 2025Ravie LakshmananVulnerability / Community Safety
A suspected cyber espionage exercise cluster that was beforehand discovered focusing on international authorities and personal sector organizations spanning Africa, Asia, North America, South America, and Oceania has been assessed to be a Chinese language state-sponsored menace actor.
Recorded Future, which was monitoring the exercise underneath the moniker TAG-100, has now graduated it to a hacking group dubbed RedNovember. It is also tracked by Microsoft as Storm-2077.
“Between June 2024 and July 2025, RedNovember (which overlaps with Storm-2077) focused perimeter home equipment of high-profile organizations globally and used the Go-based backdoor Pantegana and Cobalt Strike as a part of its intrusions,” the Mastercard-owned firm stated in a report shared with The Hacker Information.
“The group has expanded its focusing on remit throughout authorities and personal sector organizations, together with protection and aerospace organizations, area organizations, and regulation corporations.”
A few of the probably new victims of the menace actor embrace a ministry of overseas affairs in central Asia, a state safety group in Africa, a European authorities directorate, and a Southeast Asian authorities. The group can also be believed to have breached two at the least two United States (US) protection contractors, a European engine producer, and a trade-focused intergovernmental cooperation physique in Southeast Asia.
RedNovember was first documented by Recorded Future over a 12 months in the past, detailing its use of the Pantegana post-exploitation framework and Spark RAT following the weaponization of recognized safety flaws in a number of internet-facing perimeter home equipment from Verify Level (CVE-2024-24919), Cisco, Citrix, F5, Fortinet, Ivanti, Palo Alto Networks (CVE-2024-3400), and SonicWall for preliminary entry.
The concentrate on focusing on safety options akin to VPNs, firewalls, load balancers, virtualization infrastructure, and electronic mail servers mirrors a development that has been more and more adopted by different Chinese language state-sponsored hacking teams to interrupt into networks of curiosity and keep persistence for prolonged intervals of time.
A noteworthy side of the menace actor’s tradecraft is using Pantegana and Spark RAT, each of that are open-source instruments. The adoption is probably going an try and repurpose present packages to their benefit and confuse attribution efforts, a trademark of espionage actors.
The assaults additionally contain using a variant of the publicly obtainable Go-based loader LESLIELOADER to launch Spark RAT or Cobalt Strike Beacons on compromised gadgets.
RedNovember is alleged to utilize VPN companies like ExpressVPN and Warp VPN to manage and join to 2 units of servers which can be used for exploitation of internet-facing gadgets and talk with Pantegana, Spark RAT, and Cobalt Strike, one other legit program that has been broadly abused by unhealthy actors.
Between June 2024 and Might 2025, a lot of the hacking group’s focusing on efforts have been targeted on Panama, the U.S., Taiwan, and South Korea. As just lately as April 2025, it has been discovered to focus on Ivanti Join Safe home equipment related to a newspaper and an engineering and navy contractor, each based mostly within the U.S.
Recorded Future stated it additionally recognized the adversary probably focusing on the Microsoft Outlook Internet Entry (OWA) portals belonging to a South American nation earlier than that nation’s state go to to China.
“RedNovember has traditionally focused a various vary of nations and sectors, suggesting broad and altering intelligence necessities,” the corporate famous. “RedNovember’s exercise thus far has primarily targeted on a number of key geographies, together with the US, Southeast Asia, the Pacific area, and South America.”
