- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2015–2026
- Status
- Active
- ATT&CK
- G0029 · 1 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0053 · scarlet-mimic
ChinaWhat it is
Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0029
- Other names
- Golfing Taurus
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Sectors
- Activists
Tools
The tools and malware families the sources tie to it.
- BrutishCommand
- CallMe
- China Chopper
- CrypticConvo
- Elirks
- FakeFish
- FakeHighFive
- FakeM
- FullThrottle
- HTran
- MobileOrder
- PiggyBack
- Psylo
- RaidBase
- SHIPSHAPE
- SkiBoot
- SubtractThis
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de