RedGolf

Reports per quarter

CVEs named in reports

• CVE-2021-26855 KEV ransomware
• CVE-2021-26857 KEV ransomware
• CVE-2021-26858 KEV ransomware
• CVE-2021-27065 KEV ransomware
• CVE-2022-24682 KEV ransomware
• CVE-2022-27924 KEV ransomware
• CVE-2022-27925 KEV ransomware
• CVE-2022-30333 KEV ransomware
• CVE-2022-37042 KEV ransomware
• CVE-2024-23108
• CVE-2024-23109

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   KeyPlug Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor KeyPlug Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company

2. 6 April 2026

   PlugX (Malware Family)

   date ORKL added it fromORKL

   The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PlugX (Malware Family)

3. 23 January 2025

   Suspected KEYPLUG Infrastructure: TLS Certificates and GhostWolf Links

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Suspected KEYPLUG Infrastructure: TLS Certificates and GhostWolf Links

4. 7 August 2023

   RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

5. 30 March 2023

   With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Newest first. Details opens the report in Explore.