New Chinese Espionage Hacking Group Uncovered

A hacking group associated with widespread compromise of edge devices is a Chinese-state-aligned group, says cybersecurity firm Recorded Future.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

The firm spotted the threat actor in July 2024, tracking it as TAG100. Based on analysis of the group’s latest activities and tactics, Recorded Future says the group, which it now tracks as RedNovember, is “highly likely a Chinese state-sponsored threat activity group.”

“RedNovember reflects Beijing’s broader strategy of leveraging cyber operations as a force multiplier to advance geopolitical goals and military readiness, maintain intelligence collection and pressure in strategically critical areas like the Panama Canal,” said Alexander Leslie, national security and intelligence leader at Recorded Future’s Insikt Group.

RedNovember targeted 30 Panamanian organizations in April during U.S. Defense Secretary Pete Hegseth’s visit to the country. Similarly, the group’s hacking activities were detected in December 2024 while China conducted a surprise military exercise around Taiwan.

The group uses malware infrastructure associated with another Chinese group tracked as UNC5266 by Google Mandiant, indicating overlap in malware infrastructure. Chinese hackers commonly share tactics and tools (see: Chinese Hackers’ Evolution From Vandals to Strategists).

RedNovember has also focused on compromising edge devices, a common target for Chinese and other hackers. Chinese hacking groups that Google Mandiant tracks as UNC3886 and UNC4841 are also favor edge devices as a gateway into corporate networks (see: State Hackers’ New Frontier: Network Edge Device).

Since last year, RedNovember compromised multiple edge devices, including Cisco Adaptive Security Appliance, F5 BIG-IP, Palo Alto Networks, Sophos SSL VPN and Fortinet devices. Additionally, it targeted software-based communication and collaboration platforms 3CX, Zimbra and Outlook Web Access.

The tactics further allowed the group to expand its targets to government and private sector organizations, including defense and aerospace organizations, space organizations and law firms in the U.S., Panama, Asia and Europe.

“By systematically exploiting internet-facing devices, they bypass many traditional defenses and create persistent access to sensitive networks,” Leslie said.

Once within a breached network, the group combines proof-of-concept exploits with open-source post-exploitation frameworks Pantegana that comes with obfuscation capabilities. The group also relies on a Go payload called Leslieloader that downloads a backdoor dubbed SparkRAT

The Go variants are compliant with Windows, Linux and OSX. They support file upload and download, system fingerprinting and direct command-line interaction with infected hosts.

The group’s use of open-source tools is a prime example of how Chinese state-aligned hackers use “low-cost, scalable tools to achieve high-value espionage,” Leslie said.