Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain
By Insikt Group®
Excerpt
The group has used LNK files and MSC
files as the first-stage components
and ultimately loaded PlugX via search
order hijacking.
The group consistently used
Cloudflare's CDN to proxy C2
traffic to threat actor-controlled
C2 servers. This enables RedDelta
to blend in with legitimate traffic and
complicates victim identification.
RedDelta is potentially operating
out of Henan province. Insikt Group
identified ten IP addresses in Henan
province u…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Recorded Future on go.recordedfuture.com.
Mentioned in the excerpt
More from Recorded Future21
- BlueDelta Targets Defense and Diplomacy with HOOKEDGERecorded Future · Added 23 Sep
- Latin America and the Caribbean Cybercrime LandscapeRecorded Future · Added 4 Jun
- GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain AttackRecorded Future · Added 17 Apr
- DRAT V2: Updated DRAT Emerges in TAG-140’s ArsenalRecorded Future · Added 17 Aug 2025
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
