Loading threat actor…
RedExt is an open-source command-and-control browser extension framework that has been leveraged by Russian-speaking threat actors in software supply chain operations involving malicious Visual Studio Code extensions. In the observed activity, operators used the framework in campaigns distributing the GlassWorm malware through trojanized extensions published to the Open VSX ecosystem. The operation relied on extension-based delivery and defense-evasion measures including invisible Unicode obfuscation to hinder detection and bypass marketplace security controls. Reported victimology indicates impact across dozens of organizations globally, including organizations in the United States. Available evidence supports RedExt as tooling associated with financially oriented malicious activity, but the currently available information does not establish a distinct, fully characterized threat actor cluster beyond the use of this framework by Russian-speaking operators.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.