Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 14:12:56 UTC
Home > List all groups > List all tools > List all groups using tool RedCore
 Tool: RedCore
Names RedCore
Category Malware
Type Backdoor, Downloader, Info stealer, Keylogger
Description
(Kaspersky) When inspecting the NewCore RAT malware delivered during the various attacks
we investigated, we were able to distinguish between two variants. Both were deployed as
side-loaded DLLs and shared multiple similarities, both in code and behavior. At the same
time, we noticed differences that indicate the variants could have been used by different
operators.
Our analysis shows that the underlying pieces of malware and the way they were used form
two clusters of activity. As a result, we named the variants BlueCore and RedCore and
examined the artifacts we found around each one in order to profile their related clusters.
Information Last change to this tool card: 15 May 2021
Download this tool card in JSON format
All groups using tool RedCore
Changed Name Country Observed
APT groups
 Goblin Panda, Cycldek, Conimes 2013-Jun 2020
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d9af543c-8b48-4294-b2e3-d64e91f6cc02
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d9af543c-8b48-4294-b2e3-d64e91f6cc02
Page 1 of 1