RedGolf

Executive Summary

RedGolf is a high-sophistication cyber threat group attributed to Chinese state-sponsored activity. Known for dual-motivations of espionage and financial gain, RedGolf operates across sectors including education, government, media, and IT, leveraging custom backdoors like KEYPLUG. This group poses significant risks to data integrity and national security.

Goals & Targeting

RedGolf's strategic objectives appear to include state-sponsored espionage alongside financially driven operations. The group primarily targets sectors that hold sensitive information such as education, government, media, and IT. Their victims are often organizations with access to valuable data or resources that can be exploited for both intelligence and economic gain.

RedGolf is a cyber threat actor tracked by Recorded Future's Insikt Group, identified through extensive operational infrastructure linked to the use of the KEYPLUG backdoor tool. The group is highly likely to be Chinese state-sponsored, with activity overlapping APT41/BARIUM since at least 2014. RedGolf engages in both espionage and financially motivated operations, targeting sectors critical for intelligence gathering and financial gain. Their activities suggest a well-organized structure capable of complex attacks, while their dual motivations make them particularly versatile in attack vectors and targets.

Key Capabilities

• Custom Windows and Linux backdoors (KEYPLUG)
• Spear-phishing campaigns
• Social engineering techniques
• Persistence mechanisms
• Data exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RedGolf's campaigns are characterized by long-term, stealthy operations leveraging custom malware and sophisticated attack vectors. The group has demonstrated the ability to persistently target multiple industries while maintaining a low profile. Notable for dual-motivations, RedGolf balances state-sponsored espionage with financially driven activities, making their operations diverse and challenging to detect.

IOC Patterns

• Spear-phishing emails with macro-laced Office documents
• Use of custom backdoors for persistence and data exfiltration
• Lateral movement across compromised networks

Recommended Actions

• Patch systems against known vulnerabilities related to the KEYPLUG backdoor.
• Implement Endpoint Detection and Response (EDR) solutions to detect malicious processes and behaviors linked to RedGolf's TTPs.
• Use email filtering and threat detection solutions to uncover phishing attempts with macro-laced attachments.
• Monitor network traffic for signs of unauthorized exfiltration or lateral movement consistent with RedGolf campaigns.

Suggested Tags