RedNovember: Chinese APT Expands Global Espionage to U.S. Defense, Aerospace, and Tech Firms

A new report from Recorded Future’s Insikt Group says the Chinese state‑sponsored threat group RedNovember has broadened its operations to strike government, defence, aerospace and technology sectors worldwide.

According to Insikt Group, RedNovember now targets the US defence industrial base and high‑tech manufacturing, including semiconductors, and has grown beyond traditional government and diplomatic entities to include law firms, semiconductor firms in Taiwan, European manufacturers and US oil and gas companies, with at least two US defence contractors among its victims.

Between June 2024 and July 2025, the group has relied on the Go‑based backdoor Pantegana, Cobalt Strike, and SparkRAT for reconnaissance, lateral movement and persistent command‑and‑control, while using an open‑source loader called LESLIELOADER to deploy SparkRAT and Cobalt Strike.

Insikt Group notes RedNovember reconnoitred edge devices such as SonicWall, Cisco ASA, F5 BIG-IP, Palo Alto GlobalProtect, Sophos SSL VPN, Fortinet FortiGate and OWA instances, and highlights a propensity to exploit newly released vulnerabilities rapidly, including CVE‑2024‑24919. The report urges organisations to patch perimeter appliances, monitor for C2 activity, harden networks and detect post‑exploitation tactics like web shells and backdoors.