A suspected cyber espionage exercise cluster that was beforehand discovered concentrating on world authorities and personal sector organizations spanning Africa, Asia, North America, South America, and Oceania has been assessed to be a Chinese language state-sponsored risk actor.
Recorded Future, which was monitoring the exercise below the moniker TAG-100, has now graduated it to a hacking group dubbed RedNovember. It is also tracked by Microsoft as Storm-2077.
“Between June 2024 and July 2025, RedNovember (which overlaps with Storm-2077) focused perimeter home equipment of high-profile organizations globally and used the Go-based backdoor Pantegana and Cobalt Strike as a part of its intrusions,” the Mastercard-owned firm mentioned in a report shared with The Hacker Information.
“The group has expanded its concentrating on remit throughout authorities and personal sector organizations, together with protection and aerospace organizations, area organizations, and legislation companies.”
Among the possible new victims of the risk actor embrace a ministry of overseas affairs in central Asia, a state security group in Africa, a European authorities directorate, and a Southeast Asian authorities. The group can be believed to have breached two at the very least two United States (US) protection contractors, a European engine producer, and a trade-focused intergovernmental cooperation physique in Southeast Asia.
RedNovember was first documented by Recorded Future over a 12 months in the past, detailing its use of the Pantegana post-exploitation framework and Spark RAT following the weaponization of recognized security flaws in a number of internet-facing perimeter home equipment from Test Level (CVE-2024-24919), Cisco, Citrix, F5, Fortinet, Ivanti, Palo Alto Networks (CVE-2024-3400), and SonicWall for preliminary entry.
The concentrate on concentrating on security options comparable to VPNs, firewalls, load balancers, virtualization infrastructure, and e-mail servers mirrors a development that has been more and more adopted by different Chinese language state-sponsored hacking teams to interrupt into networks of curiosity and keep persistence for prolonged durations of time.
A noteworthy side of the risk actor’s tradecraft is using Pantegana and Spark RAT, each of that are open-source instruments. The adoption is probably going an try and repurpose present packages to their benefit and confuse attribution efforts, an indicator of espionage actors.
The assaults additionally contain using a variant of the publicly obtainable Go-based loader LESLIELOADER to launch Spark RAT or Cobalt Strike Beacons on compromised units.
RedNovember is alleged to utilize VPN companies like ExpressVPN and Warp VPN to manage and join to 2 units of servers which can be used for exploitation of internet-facing units and talk with Pantegana, Spark RAT, and Cobalt Strike, one other professional program that has been broadly abused by unhealthy actors.
Between June 2024 and Might 2025, a lot of the hacking group’s concentrating on efforts have been centered on Panama, the U.S., Taiwan, and South Korea. As just lately as April 2025, it has been discovered to focus on Ivanti Join Safe home equipment related to a newspaper and an engineering and army contractor, each based mostly within the U.S.
Recorded Future mentioned it additionally recognized the adversary possible concentrating on the Microsoft Outlook Net Entry (OWA) portals belonging to a South American nation earlier than that nation’s state go to to China.
“RedNovember has traditionally focused a various vary of nations and sectors, suggesting broad and altering intelligence necessities,” the corporate famous. “RedNovember’s exercise to this point has primarily centered on a number of key geographies, together with the US, Southeast Asia, the Pacific area, and South America.”
