- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored
- Agency named
- MSS, Ministry of State Security
- Motivation
- Espionage; Financial Theft; Information theft and espionage; state-sponsored espionage and financially motivated
- Seen
- 2014
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0443 · redgolf
ChinaWhat it is
Recorded Future’s Insikt Group has identified a large cluster of new operational infrastructure associated with use of the custom Windows and Linux backdoor KEYPLUG. We attribute this activity to a threat activity group tracked as RedGolf, which is highly likely to be a Chinese state-sponsored group. RedGolf closely overlaps with threat activity reported in open sources under the aliases APT41/BARIUM and has likely carried out state-sponsored espionage activity in parallel with financially motivated operations for personal gain from at least 2014 onward.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- United States
- Sectors
- Automotive, Aviation, Education, Government, Information Technology, Intergovernmental, IT, Media, Media and Entertainment, Religious Organizations
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- Cobalt Strike
- KEYPLUG
- PlugX
- Windows Remote Desktop
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de