Red Menshen
Also reported as Red Dev 18 and Earth Bluecrow. Linked to China by two sources.
Reports per quarter
Techniques seen in the last two years
- T1027 1 report
- T1041 1 report
- T1053.005 1 report
- T1059.003 1 report
- T1071.001 1 report
- T1078 1 report
- T1082 1 report
- T1095 1 report
- T1140 1 report
- T1189 1 report
Show all 16 techniques Show fewer
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2013-3900 KEV
- CVE-2017-0144 KEV ransomware
- CVE-2017-0199 KEV ransomware
- CVE-2017-0261 KEV
- CVE-2017-0262 KEV
- CVE-2017-10271 KEV ransomware
- CVE-2017-11292 KEV
- CVE-2017-11882 KEV ransomware
- CVE-2017-5638 KEV ransomware
- CVE-2017-8570 KEV
- CVE-2017-8759 KEV
- CVE-2018-0798 KEV
Show all 60 CVEs Show fewer
- CVE-2018-2628 KEV
- CVE-2018-8174 KEV ransomware
- CVE-2018-8373 KEV
- CVE-2019-1367 KEV ransomware
- CVE-2019-13720 KEV
- CVE-2019-1458 KEV ransomware
- CVE-2019-17026 KEV
- CVE-2019-17100
- CVE-2019-2725 KEV ransomware
- CVE-2019-3010 KEV
- CVE-2020-0674 KEV
- CVE-2020-0688 KEV ransomware
- CVE-2021-1472
- CVE-2021-1473
- CVE-2021-1675 KEV ransomware
- CVE-2021-1732 KEV ransomware
- CVE-2021-20021 KEV ransomware
- CVE-2021-20022 KEV ransomware
- CVE-2021-20023 KEV ransomware
- CVE-2021-2135
- CVE-2021-21975 KEV ransomware
- CVE-2021-21983
- CVE-2021-22893 KEV ransomware
- CVE-2021-26084 KEV ransomware
- CVE-2021-26855 KEV ransomware
- CVE-2021-28149
- CVE-2021-28152
- CVE-2021-28310 KEV
- CVE-2021-28482
- CVE-2021-3019
- CVE-2021-34473 KEV ransomware
- CVE-2021-34527 KEV ransomware
- CVE-2021-3490
- CVE-2021-40444 KEV ransomware
- CVE-2021-4104
- CVE-2021-44228 KEV ransomware
- CVE-2021-45046 KEV ransomware
- CVE-2021-45105
- CVE-2022-1040 KEV
- CVE-2022-27518 KEV
- CVE-2022-41328 KEV
- CVE-2022-42475 KEV ransomware
- CVE-2023-20867 KEV
- CVE-2023-2868 KEV
- CVE-2024-23204
- CVE-2024-4577 KEV ransomware
- CVE-2025-55182 KEV ransomware
- CVE-2026-21236
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Show all 75 reports Show fewer
-
Fun with the new bpfdoor (2023)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fun with the new bpfdoor (2023)
-
BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game
-
Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor
-
Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor
The original link failed its last check. Original publisher Detailsfor Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor
-
Hunting a Global Telecommunications Threat- DecisiveArchitect and Its Custom Implant JustForFun
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting a Global Telecommunications Threat- DecisiveArchitect and Its Custom Implant JustForFun
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A peek behind the BPFDoor
-
BPFDoor - An Evasive Linux Backdoor Technical Analysis
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BPFDoor - An Evasive Linux Backdoor Technical Analysis
-
Tinker Telco Soldier Spy (to be given 2022-06-27)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tinker Telco Soldier Spy (to be given 2022-06-27)
-
yir-cyber-threats-annex-download.pdf
The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf
-
yir-cyber-threats-report-download.pdf
The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-report-download.pdf
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tinker Telco Soldier Spy
-
The original link failed its last check. Original publisher Detailsfor 중국 기반 해커, 국내 에너지 기관 공격
-
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Inside a Back Door Attack
Newest first. Details opens the report in Explore.