Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

A cyber espionage cluster, believed to be a Chinese state-sponsored actor, has been reassessed as RedNovember, which previously targeted global governments and private sector organisations across Africa, Asia, the Americas and Oceania. According to Recorded Future, RedNovember (overlaps with Storm-2077) operated between June 2024 and July 2025, focusing on perimeter appliances of high-profile organisations and using the Go-based backdoor Pantegana and Cobalt Strike as part of its intrusions.

The group has expanded its targeting to government and private sector entities, including defence and aerospace organisations, space organisations and law firms, with victims in Central Asia, Africa, Europe and Southeast Asia. RedNovember is said to employ open-source tools such as Pantegana and Spark RAT, and to deploy a variant of the LESLIELOADER loader to launch Spark RAT or Cobalt Strike Beacons on compromised devices, while disguising activity with VPN services such as ExpressVPN and Warp VPN.

Between June 2024 and May 2025, Panama, the US, Taiwan and South Korea were among the focus geographies, with at least two US defence contractors and other entities cited as targets.