- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, possibly PLA and/or Nanjing Qinglan Information Technology Co. Ltd
- Motivation
- Information theft and espionage
- Seen
- 2015
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0147 · redalpha
ChinaWhat it is
Recorded Future’s Insikt Group has identified two new cyberespionage campaigns targeting the Tibetan Community over the past two years. The campaigns, which we are collectively naming RedAlpha, combine light reconnaissance, selective targeting, and diverse malicious tooling. We discovered this activity as the result of pivoting off of a new malware sample observed targeting the Tibetan community based in India.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- PwC
- Red Dev 3
- Other names
- DeepCliff
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Hong Kong, India, Myanmar, Pakistan, Sri Lanka, Thailand
- Sectors
- Government
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- FormerFirstRAT
- Gh0st RAT
- NetHelp Infostealer
- RedAlpha
- a vulnerability in MS Office
- njRAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de