RedJuliettThreat actor
RedJuliett is a likely Chinese state-sponsored threat actor targeting government, academic, technology, and diplomatic organizations in Taiwan. They exploit vulnerabilities in network edge devices for initial access and use SQL injection and directory traversal exploits against web and SQL applications.From MISP Galaxy
Last reported 15 days ago, by Security Affairs5 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1003.001LSASS Memory
“Blindsight, a publicly available tool to dump LSASS memory with evasion techniques based on transactional NTFS”
- T1003.006DCSync
“To take credentials, they ran a tool named DC.exe that uses DCSync, a technique that copies data from a domain controller through Active Directory's replication service.”
- T1110Brute Force
“… VPN software clients on victim devices for persistence, the threat actors have been found to use EBurst, an open-source Python-based brute-force tool, to target accounts in Microsoft 365 Cloud environments, and gain unauthorized access to mailbox data using a command-line utilit…”
- T1110.003Password Spraying
“The hackers also use password spraying, which means trying a few common passwords against many accounts.”
- T1195Supply Chain Compromise
“Attacks leveraging supply chain compromise.”
- T1505.003Web Shell
“Deployment of backdoors via web shells, exploitation of vulnerable public-facing servers, or similar methods.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools“Researchers have linked it to a hacking group known as Flax Typhoon, also called Ethereal Panda or RedJuliett.”
-
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions“Flax Typhoon, also tracked as Ethereal Panda and RedJuliett, is associated with Integrity Technology Group, a Beijing-based company that contracts with the Chinese government.”
-
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails“The hackers' methods are "consistent with" activity that security companies track as Flax Typhoon, Ethereal Panda, and RedJuliett, among others, the advisory said.”
-
Mines, Minds, and Machines: The Journey of AI“Insikt Group observed the Chinese state-sponsored group RedJuliett conducting vulnerability scanning or attempting exploitation against a Taiwanese semiconductor company, electronics manufacturers, technology universities, and computing industry associations.”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“…ration, where the APT group Earth Estries handed over a compromised asset to Earth Naga, another APT group also known as Flax Typhoon, RedJuliett, or Ethereal Panda.”
Indicators in its reports
named in the reports above- c0cc[.]ccin 2 reports
- back-trust-aurora.cluster-ctrjumtpbmf.mnl-east-2.timcorpnet[.]comin 1 report
- afddd9d14453d4f9-1e185df7e4.ap-southeast-mnl.timcorpnet[.]comin 1 report
- 103.175.16[.]77in 1 report
- 45.92.158[.]50in 1 report
- dns.studiocloud[.]xyzin 1 report
- 98aiblog[.]comin 1 report
- natcloudservice[.]comin 1 report
- 202.182.109[.]151in 1 report
- 2.3.20[.]2in 1 report
- 2.3.24[.]1in 1 report
- 2.3.20[.]3in 1 report
- 2.3.24[.]3in 1 report
- 2.3.28[.]1in 1 report
- 98aicai[.]comin 1 report
- 98aicode[.]comin 1 report
- outlook3650[.]comin 1 report
- youtubecard[.]comin 1 report
- linkedinns[.]netin 1 report
- w8510[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.