Chinese Cyberspies Hacked US Defense Contractors

According to Recorded Future, a Chinese cyberespionage group known as RedNovember has compromised at least two US defense contractors and numerous organisations across the Americas, Europe, Asia and Africa. The group’s activity spanned from July 2024 to July 2025, targeting government, defence, aerospace and other sectors, with initial access gained by compromising edge devices from Cisco, F5, Fortinet, Ivanti, Palo Alto Networks, SonicWall, and Sophos, as well as Outlook Web Access portals.

RedNovember deployed a Go-based backdoor named Pantegana, alongside offensive tools such as Cobalt Strike and SparkRAT, and leveraged open source utilities for reconnaissance and follow‑up operations, while continuing to rely on VPN and remote access methods including ExpressVPN and potentially Warp VPN.

The firm notes the attacks extended to OWA portals of a South American country ahead of a Chinese state visit and that the group has targeted senior US aerospace and defence organisations and other global defence entities. In April 2025, the group targeted a US engineering and military contractor, though there was insufficient evidence to confirm a compromise, with reconnaissance also observed against a US Navy‑related educational IP space.