RedDelta

Executive Summary

RedDelta, operating under the alias Mustang Panda among others, is a Chinese state-sponsored espionage group active since at least 2019 that targets government, defense and NGO entities across Europe, Southeast Asia and the U.S. It deploys a sophisticated PlugX‑based infection chain using spearphishing, Office file exploits (e.g., CVE‑2017‑0199) and cloud-hosted staging to exfiltrate data. The group shifts its focus in response to geopolitical events, expanding attacks on European diplomatic bodies after Russia’s invasion of Ukraine and previously targeting the Vatican during CCP negotiations.

Goals & Targeting

RedDelta’s strategic objectives revolve around gathering politically sensitive intelligence from state and quasi‑state actors, research institutions, NGOs, and religious bodies to support Chinese national interests. The group focuses on entities that can provide insights into foreign policy decisions, security collaborations or economic developments beyond its borders. By targeting a mix of governmental and non‑governmental organizations—especially those involved in diplomacy, finance, maritime security, energy infrastructure and religious affairs—RedDelta seeks to harvest strategic data while maintaining operational stealth through tailored phishing lures and covert exfiltration channels.

Key Capabilities

• Spearphishing attachments and links that incorporate Office exploits (CVE‑2017‑0199) and custom MSC files
• Deployment of a PlugX backdoor for persistence, lateral movement and data exfiltration
• Use of password-Protected RAR archives staged with WinRAR (rar.exe) as temporary storage before exfiltration
• Obfuscation tactics such as hidden RECYCLE.BIN folders on removable media, altered file timestamps and masqueraded executables
• Exploitation of LNK files to execute malicious payloads while displaying innocuous PDF icons
• Leveraging legitimate email marketing services (SMTP2Go) and custom mail accounts for phishing campaigns
• Staging malware on adversary‑controlled domains and cloud storage, including Google Drive links
• Routing command‑and‑control traffic via the Cloudflare CDN to obfuscate infrastructure
• Active Directory reconnaissance using AdFind and SharpNBTScan
• Process discovery using tasklist, TONESHELL and other post‑exploitation tools (Impacket, RemCom)

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RedDelta’s campaigns have been characterized by adaptive targeting that reflects shifting geopolitical contexts. Since 2019, the group has maintained a consistent presence in Southeast Asia (Myanmar and Vietnam), while expanding to European governments and NGOs post‑2022 following Russia’s invasion of Ukraine. Attack bursts often correlate with high‑profile diplomatic events—such as CCP–Vatican talks in 2021—during which the actor intensifies phishing efforts against religious and NGO institutions. Operations are typically executed through cloud staging, sophisticated delivery lures, and hardened command‑and‑control channels routed via Cloudflare, enabling rapid scalability while preserving attribution ambiguity. The actor shows a preference for exploiting known Office vulnerabilities or creating custom malicious MSC files, suggesting a blend of opportunistic and development resources. RedDelta’s persistence mechanisms—particularly China Chopper web shells and PlugX backdoors—are routinely refreshed, indicating continuous support and evolution from its sponsoring nation‑state apparatus.

IOC Patterns

• Password‑protected RAR archives used for data staging
• Hidden RECYCLE.BIN folders on USB drives
• Altered file attributes (hidden/system)
• Modified timestamps derived from the export address table
• Masqueraded executables disguised as legitimate PlugX installers
• LNK files configured to display a PDF icon for malicious execution
• URL‑based phishing links
• Google Drive download URLs
• Malicious JavaScript downloader scripts
• Tracking pixel URLs
• Spearfishing attachment delivery
• Spearfishing link emails targeting government/NGO entities
• Malicious MSC file downloads from Azure‑hosted sites
• Windows LNK exploitation for code execution
• User agent fingerprinting of victim OS
• Cloudflare CDN used to proxy C2 traffic
• Cloud storage staging of malware

Recommended Actions

• Patch Microsoft Office to mitigate CVE‑2017‑0199 and related file‑format exploits.
• Monitor and block traffic to known malicious C2 domains used by Mustang Panda.
• Implement stricter controls on the use of legitimate email marketing services such as SMTP2Go for outbound phishing.
• Detect and block the creation of hidden folders (e.g., RECYCLE.BIN) on removable drives.
• Deploy tools that detect altered file attributes, timestamps, or masquerading tactics.
• Enable detection of LNK abuse through application whitelisting and script analysis.
• Apply granular monitoring for RAR/ZIP attachments in email gateways to flag potential data staging.
• Use endpoint detection platforms to identify WinRAR execution patterns associated with exfiltration.
• Implement multi‑factor authentication and strengthen user security awareness training to guard against phishing emails.
• Deploy email filtering solutions that block malicious attachments and URLs, including Google Drive links.
• Enforce EDR monitoring to detect suspicious process discovery activity (tasklist/Toneshell) and anomalous use of Visual Studio Code tunnels.
• Block known adversary‑controlled domains and cloud file hosting services used for staging malware.
• Monitor network traffic for unusual JavaScript redirects and tracking pixels that indicate successful delivery.
• Implement email filtering and sandboxing to block spearphishing attachments and links.
• Monitor and restrict execution of MSC and LNK files from untrusted sources.
• Deploy EDR solutions with signatures for PlugX, Poison Ivy, and Cobalt Strike.
• Analyze outbound traffic via Cloudflare CDN to detect anomalous patterns.
• Provide user awareness training on phishing targeting diplomatic and NGO organizations.
• Strengthen network defenses and security measures for religious and non‑governmental organizations to mitigate attacks from state‑sponsored threat actors like RedDelta.

Suggested Tags