RedNovember Hackers Targeting Government and Tech Organizations to Install Backdoor

According to Recorded Future’s Insikt Group, TAG-100 was exposed in July 2024 as a cyber-espionage campaign that leveraged the Go-based backdoor Pantegana against high-profile government, intergovernmental and private organisations worldwide, and TAG-100 has since been attributed to a Chinese state-sponsored threat actor designated RedNovember.

Between June 2024 and July 2025, RedNovember—overlapping with Storm-2077—expanded its operations to target perimeter appliances and VPN solutions, deploying Pantegana and Cobalt Strike to establish persistence.

The group’s victims include ministries of foreign affairs in Central Asia and Southeast Asia, a state security organisation in Africa, a European government directorate, two US defence contractors, a European engine manufacturer and a trade-focused intergovernmental body in Southeast Asia, with edge devices such as firewalls, VPNs, load balancers and email servers remaining the primary initial access vector.

In April 2025, RedNovember mounted a focused campaign against Ivanti Connect Secure VPN appliances, scanning targets including a major US newspaper and a specialised engineering and military contractor. The campaign coincided with geopolitical events, and RedNovember continues to rely on open-source and commodity C2 frameworks—Pantegana, Cobalt Strike and SparkRAT—for reconnaissance, initial access and probable compromise.

Analysts note that RedNovember has broadened its targeting to include the US Defence Industrial Base and European space and aerospace organisations through spearphishing and exploitation, while using Go-based loaders to sideload SparkRAT and Cobalt Strike Beacon in memory.