{
	"id": "c6497bc6-6468-4419-858d-2c9964a95beb",
	"created_at": "2026-04-06T00:17:03.247556Z",
	"updated_at": "2026-04-10T03:37:58.674668Z",
	"deleted_at": null,
	"sha1_hash": "b4e953a12bf0ec88d412efe0d88c745502dab499",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 55872,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 17:03:35 UTC\r\n APT group: RedAlpha\r\nNames\r\nRedAlpha (Recorded Future)\r\nDeepCliff (?)\r\nRed Dev 3 (PWC)\r\nCountry China\r\nSponsor\r\nState-sponsored, possibly PLA and/or Nanjing Qinglan Information Technology Co.\r\nLtd\r\nMotivation Information theft and espionage\r\nFirst seen 2015\r\nDescription\r\nThe original research from Citizen Lab did not give this group a name.\r\n(Recorded Future) Recorded Future’s Insikt Group has identified two new\r\ncyberespionage campaigns targeting the Tibetan community over the past two years.\r\nThe campaigns, which we are collectively naming RedAlpha, combine light\r\nreconnaissance, selective targeting, and diverse malicious tooling. We discovered\r\nthis activity as the result of pivoting off of a new malware sample observed targeting\r\nthe Tibetan community based in India.\r\nInsikt Group’s analysis of infrastructure overlap among the new campaigns reveals\r\nwider targeting of the Chinese “Five Poisons,” in addition to South and Southeast\r\nAsian governments. Based on the campaign’s targeting of “Five Poisons”-related\r\norganizations, overlapping infrastructure, and links to malware used by other\r\nChinese APTs uncovered during our research, we assess with medium confidence\r\nthat the RedAlpha campaigns were conducted by a Chinese APT.\r\nInfrastructure overlaps have been found with APT 17, Deputy Dog, Elderwood,\r\nSneaky Panda, Icefog, Dagger Panda and NetTraveler, APT 21, Hammer Panda.\r\nObserved\r\nSectors: Government and the Tibetan and Uyghur communities and Falun Gong\r\nsupporters.\r\nCountries: Hong Kong, India, Myanmar, Pakistan, Sri Lanka, Thailand and South\r\nand Southeast Asia.\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9\r\nPage 1 of 2\n\nTools used\nFormerFirstRAT, Gh0st RAT, NetHelp Infostealer, njRAT, RedAlpha and a\nvulnerability in MS Office.\nOperations performed\n2017\nRedAlpha: New Campaigns Discovered Targeting the Tibetan Community\n2021\nRedAlpha Conducts Multi-Year Credential Theft Campaign Targeting\nGlobal Humanitarian, Think Tank, and Government Organizations\nInformation\nLast change to this card: 10 March 2024\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9"
	],
	"report_names": [
		"showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9"
	],
	"threat_actors": [
		{
			"id": "2150d1ac-edf0-46d4-a78a-a8899e45b2b5",
			"created_at": "2022-10-25T15:50:23.269339Z",
			"updated_at": "2026-04-10T02:00:05.402835Z",
			"deleted_at": null,
			"main_name": "APT17",
			"aliases": [
				"APT17",
				"Deputy Dog"
			],
			"source_name": "MITRE:APT17",
			"tools": [
				"BLACKCOFFEE"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "808d8d52-ca06-4a5f-a2c1-e7b1ce986680",
			"created_at": "2022-10-25T16:07:23.899157Z",
			"updated_at": "2026-04-10T02:00:04.782542Z",
			"deleted_at": null,
			"main_name": "NetTraveler",
			"aliases": [
				"APT 21",
				"Hammer Panda",
				"NetTraveler",
				"TEMP.Zhenbao"
			],
			"source_name": "ETDA:NetTraveler",
			"tools": [
				"Agent.dhwf",
				"Destroy RAT",
				"DestroyRAT",
				"Kaba",
				"Korplug",
				"NetTraveler",
				"Netfile",
				"PlugX",
				"RedDelta",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"TravNet",
				"Xamtrav"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "1aead86d-0c57-4e3b-b464-a69f6de20cde",
			"created_at": "2023-01-06T13:46:38.318176Z",
			"updated_at": "2026-04-10T02:00:02.925424Z",
			"deleted_at": null,
			"main_name": "DAGGER PANDA",
			"aliases": [
				"UAT-7290",
				"Red Foxtrot",
				"IceFog",
				"RedFoxtrot",
				"Red Wendigo",
				"PLA Unit 69010"
			],
			"source_name": "MISPGALAXY:DAGGER PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "a339e456-3f5a-40e9-b293-233281105e85",
			"created_at": "2022-10-25T15:50:23.260847Z",
			"updated_at": "2026-04-10T02:00:05.248583Z",
			"deleted_at": null,
			"main_name": "Elderwood",
			"aliases": [
				"Elderwood",
				"Elderwood Gang",
				"Beijing Group",
				"Sneaky Panda"
			],
			"source_name": "MITRE:Elderwood",
			"tools": [
				"PoisonIvy",
				"Naid",
				"Briba",
				"Hydraq",
				"Linfo",
				"Nerex",
				"Vasport",
				"Wiarp",
				"Pasam"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "9381a9dc-8d8e-453a-9fe5-301136ff0f83",
			"created_at": "2023-01-06T13:46:38.775762Z",
			"updated_at": "2026-04-10T02:00:03.096032Z",
			"deleted_at": null,
			"main_name": "RedAlpha",
			"aliases": [
				"DeepCliff",
				"Red Dev 3"
			],
			"source_name": "MISPGALAXY:RedAlpha",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "cc8271a3-471f-4b8c-9da6-7d50f8ccabaa",
			"created_at": "2022-10-25T16:07:24.107066Z",
			"updated_at": "2026-04-10T02:00:04.868213Z",
			"deleted_at": null,
			"main_name": "RedAlpha",
			"aliases": [
				"DeepCliff",
				"Red Dev 3"
			],
			"source_name": "ETDA:RedAlpha",
			"tools": [
				"AngryRebel",
				"Bladabindi",
				"FF-RAT",
				"Farfli",
				"FormerFirstRAT",
				"Gh0st RAT",
				"Ghost RAT",
				"Jorik",
				"Moudour",
				"Mydoor",
				"NetHelp Infostealer",
				"NetHelp Striker",
				"PCRat",
				"RedAlpha",
				"ffrat",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "5d9dfc61-6138-497a-b9da-33885539f19c",
			"created_at": "2022-10-25T16:07:23.720008Z",
			"updated_at": "2026-04-10T02:00:04.726002Z",
			"deleted_at": null,
			"main_name": "Icefog",
			"aliases": [
				"ATK 23",
				"Dagger Panda",
				"Icefog",
				"Red Wendigo"
			],
			"source_name": "ETDA:Icefog",
			"tools": [
				"8.t Dropper",
				"8.t RTF exploit builder",
				"8t_dropper",
				"Dagger Three",
				"Fucobha",
				"Icefog",
				"Javafog",
				"POISONPLUG.SHADOW",
				"RoyalRoad",
				"ShadowPad Winnti",
				"XShellGhost"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "254f2fab-5834-4d90-9205-d80e63d6d867",
			"created_at": "2023-01-06T13:46:38.31544Z",
			"updated_at": "2026-04-10T02:00:02.924166Z",
			"deleted_at": null,
			"main_name": "APT21",
			"aliases": [
				"HAMMER PANDA",
				"TEMP.Zhenbao",
				"NetTraveler"
			],
			"source_name": "MISPGALAXY:APT21",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "57d2c58d-0445-441f-b94f-99d217b9e3c4",
			"created_at": "2023-01-06T13:46:38.327743Z",
			"updated_at": "2026-04-10T02:00:02.930027Z",
			"deleted_at": null,
			"main_name": "Beijing Group",
			"aliases": [
				"Elderwood",
				"Elderwood Gang",
				"SIG22",
				"G0066",
				"SNEAKY PANDA"
			],
			"source_name": "MISPGALAXY:Beijing Group",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "86fd71d3-06dc-4b73-b038-cedea7b83bac",
			"created_at": "2022-10-25T16:07:23.330793Z",
			"updated_at": "2026-04-10T02:00:04.545236Z",
			"deleted_at": null,
			"main_name": "APT 17",
			"aliases": [
				"APT 17",
				"ATK 2",
				"Beijing Group",
				"Bronze Keystone",
				"Deputy Dog",
				"Elderwood",
				"Elderwood Gang",
				"G0025",
				"G0066",
				"Operation Aurora",
				"Operation DeputyDog",
				"Operation Ephemeral Hydra",
				"Operation RAT Cook",
				"SIG22",
				"Sneaky Panda",
				"TEMP.Avengers",
				"TG-8153",
				"Tailgater Team"
			],
			"source_name": "ETDA:APT 17",
			"tools": [
				"9002 RAT",
				"AGENT.ABQMR",
				"AGENT.AQUP.DROPPER",
				"AGENT.BMZA",
				"AGENT.GUNZ",
				"Agent.dhwf",
				"AngryRebel",
				"BlackCoffee",
				"Briba",
				"Chymine",
				"Comfoo",
				"Comfoo RAT",
				"Darkmoon",
				"DeputyDog",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Fexel",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"Gresim",
				"HOMEUNIX",
				"HiKit",
				"HidraQ",
				"Homux",
				"Hydraq",
				"Jumpall",
				"Kaba",
				"Korplug",
				"Linfo",
				"MCRAT.A",
				"McRAT",
				"MdmBot",
				"Mdmbot.E",
				"Moudour",
				"Mydoor",
				"Naid",
				"Nerex",
				"PCRat",
				"PNGRAT",
				"Pasam",
				"PlugX",
				"Poison Ivy",
				"RedDelta",
				"Roarur",
				"SPIVY",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trojan.Naid",
				"Vasport",
				"Wiarp",
				"Xamtrav",
				"Zox",
				"ZoxPNG",
				"ZoxRPC",
				"gresim",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434623,
	"ts_updated_at": 1775792278,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b4e953a12bf0ec88d412efe0d88c745502dab499.pdf",
		"text": "https://archive.orkl.eu/b4e953a12bf0ec88d412efe0d88c745502dab499.txt",
		"img": "https://archive.orkl.eu/b4e953a12bf0ec88d412efe0d88c745502dab499.jpg"
	}
}