Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:03:35 UTC
 APT group: RedAlpha
Names
RedAlpha (Recorded Future)
DeepCliff (?)
Red Dev 3 (PWC)
Country China
Sponsor
State-sponsored, possibly PLA and/or Nanjing Qinglan Information Technology Co.
Ltd
Motivation Information theft and espionage
First seen 2015
Description
The original research from Citizen Lab did not give this group a name.
(Recorded Future) Recorded Future’s Insikt Group has identified two new
cyberespionage campaigns targeting the Tibetan community over the past two years.
The campaigns, which we are collectively naming RedAlpha, combine light
reconnaissance, selective targeting, and diverse malicious tooling. We discovered
this activity as the result of pivoting off of a new malware sample observed targeting
the Tibetan community based in India.
Insikt Group’s analysis of infrastructure overlap among the new campaigns reveals
wider targeting of the Chinese “Five Poisons,” in addition to South and Southeast
Asian governments. Based on the campaign’s targeting of “Five Poisons”-related
organizations, overlapping infrastructure, and links to malware used by other
Chinese APTs uncovered during our research, we assess with medium confidence
that the RedAlpha campaigns were conducted by a Chinese APT.
Infrastructure overlaps have been found with APT 17, Deputy Dog, Elderwood,
Sneaky Panda, Icefog, Dagger Panda and NetTraveler, APT 21, Hammer Panda.
Observed
Sectors: Government and the Tibetan and Uyghur communities and Falun Gong
supporters.
Countries: Hong Kong, India, Myanmar, Pakistan, Sri Lanka, Thailand and South
and Southeast Asia.
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9
Page 1 of 2

Tools used
FormerFirstRAT, Gh0st RAT, NetHelp Infostealer, njRAT, RedAlpha and a
vulnerability in MS Office.
Operations performed
2017
RedAlpha: New Campaigns Discovered Targeting the Tibetan Community
2021
RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting
Global Humanitarian, Think Tank, and Government Organizations
Information
Last change to this card: 10 March 2024
Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e049d10f-81fd-4cc0-bb61-46f75594a1b9
Page 2 of 2