RedAlpha

Also reported as DeepCliff and Red Dev 3. Linked to China by one source.

Reports: 8
Last reported: 19 March 2024
Known CVEs: 12
Origin: China

ID: redalpha
Sources: MISP ETDA Malpedia
Merge evidence: 6 alias matches

Reports per quarter

2018 Q2: 1 report
2018 Q3: 3 reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: 1 report
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: 1 report
2022 Q3: 1 report
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: 1 report

Dated reports, 2018 Q2 to 2024 Q1.

CVEs named in reports

CVE-2013-3900 KEV
CVE-2017-0199 KEV ransomware
CVE-2017-11882 KEV ransomware
CVE-2018-0802 KEV ransomware
CVE-2020-0688 KEV ransomware
CVE-2021-1675 KEV ransomware
CVE-2021-34527 KEV ransomware
CVE-2021-40444 KEV ransomware
CVE-2021-4104
CVE-2021-44228 KEV ransomware
CVE-2021-45046 KEV ransomware
CVE-2021-45105

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

19 March 2024

Attributing i-SOON: Private Contractor Linked to Multiple Chinese State-sponsored Groups

file creation date fromORKL

Archived copy on ORKL Detailsfor Attributing i-SOON: Private Contractor Linked to Multiple Chinese State-sponsored Groups
16 August 2022

RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting Global Humanitarian, Think Tank, and Government Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting Global Humanitarian, Think Tank, and Government Organizations
28 April 2022

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf
29 July 2020

Chinese State-Sponsored Group 'RedDelta' Targets the Vatican and Catholic Organizations

Malpedia library date Recorded Future fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese State-Sponsored Group 'RedDelta' Targets the Vatican and Catholic Organizations
20 August 2018

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

file creation date fromORKL

Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure
16 August 2018

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

date in the CCS '25 data Recorded Future fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure
16 August 2018

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure
26 June 2018

RedAlpha: New Campaigns Discovered Targeting the Tibetan Community

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedAlpha: New Campaigns Discovered Targeting the Tibetan Community

Newest first. Details opens the report in Explore.