{"id":1097,"date":"2025-01-12T21:19:12","date_gmt":"2025-01-12T21:19:12","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/12\/reddelta-spreads-plugx-malware-in-espionage-campaigns\/"},"modified":"2025-01-12T21:19:13","modified_gmt":"2025-01-12T21:19:13","slug":"reddelta-spreads-plugx-malware-in-espionage-campaigns","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/reddelta-spreads-plugx-malware-in-espionage-campaigns\/","title":{"rendered":"RedDelta Spreads PlugX Malware in Espionage Campaigns"},"content":{"rendered":"\n<\/p>\n

Cyber Espionage \/ Cyber Attack<\/strong><\/p>\n

\n

\ue802<\/i>Jan 10, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cyber Espionage \/ Cyber Attack<\/span><\/p>\n<\/div>\n

\n
\n <\/a>\n <\/div>\n

Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia have been targeted by the China-nexus RedDelta threat actor to deliver a customized version of the PlugX backdoor between July 2023 and December 2024.<\/p>\n

“The group used lure documents themed around the 2024 Taiwanese presidential candidate Terry Gou, the Vietnamese National Holiday, flood protection in Mongolia, and meeting invitations, including an Association of Southeast Asian Nations (ASEAN) meeting,” Recorded Future’s Insikt Group said<\/a> in a new analysis.<\/p>\n

It’s believed that the group’s activities align with Chinese strategic priorities, focusing on governments and diplomatic organizations in Southeast Asia, Mongolia, and Europe.<\/p>\n

“RedDelta’s activities align with Chinese strategic priorities, focusing on governments and diplomatic organizations in Southeast Asia, Mongolia, and Europe,” the company said.<\/p>\n

“The group’s Asia-focused targeting in 2023 and 2024 represents a return to the group’s historical focus after targeting European organizations in 2022. RedDelta’s targeting of Mongolia and Taiwan is consistent with the group’s past targeting of groups seen as threats to the Chinese Communist Party’s power.”<\/p>\n

The development comes amid a report<\/a> from Bloomberg that the recent cyber attack<\/a> targeting the U.S. Treasury Department was perpetrated by a fellow hacking group known as Silk Typhoon (aka Hafnium), which was previously attributed to the zero-day exploitation<\/a> of four security flaws in Microsoft Exchange Server (aka ProxyLogon) in early 2021.<\/p>\n

<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n