- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- China(high confidence)
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0442 · red-nue
ChinaWhat it is
Red Nue, active since at least 2017, is known for its use of the multi-platform LootRAt backdoor, also known as ReverseWindow. LootRAT has variants for Windows and Macintosh (reported in open source as Demsty), as well as an Android variant known as SpyDealer. Red Nue has also used another Windows backdoor known as WinDealer since at least 2019, when it deployed it to targets as part of a watering hole campaign on a Chinese news website for the Chinese diaspora community. Parts of Asia feature heavily in Red Nue's victimology.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- LuoYu
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Androrat
- Backdoor.Oldrea
- DroidJack
- Windows Remote Desktop
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de