Loading threat actor…
Red Foxtrot is a China-linked cyber-espionage threat cluster that has been publicly associated with the Chinese People’s Liberation Army, specifically PLA Unit 69010. The group has been linked through overlaps in victimology, infrastructure, and tooling with other China-nexus activity and is associated with espionage operations against strategically significant targets. Reporting has connected Red Foxtrot with activity overlapping UAT-7290, a China-nexus actor active since at least 2022 that has targeted critical infrastructure, especially telecommunications providers in South Asia, with more recent expansion into Southeastern Europe. The cluster is associated with reconnaissance-heavy intrusion activity, exploitation of one-day vulnerabilities in internet-facing edge devices, and target-specific SSH brute-force operations to obtain initial access. Related operations have used primarily Linux-focused malware on edge infrastructure, including RushDrop, DriveSwitch, SilentRaid, and Bulbature, while also showing overlap with Windows malware and infrastructure associated with RedLeaves and ShadowPad. Observed capabilities include establishing persistent access, remote shell execution, file management, port forwarding, use of compromised infrastructure as relay nodes, and deep post-compromise embedding in victim environments. Operational patterns suggest an espionage mission and possible support to broader China-aligned operations through provision of relay or initial-access infrastructure.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked threat actor publicly linked by Recorded Future to PLA Unit 69010 and noted here for overlap in victimology, infrastructure, and tooling with UAT-7290.
China-linked threat actor referenced because UAT-7290 shares overlap in victimology, infrastructure, and tooling with it; publicly linked to PLA Unit 69010.
Referenced as a China-linked threat actor whose victimology and infrastructure overlap with UAT-7290.
China-linked threat group referenced due to overlap with UAT-7290 in victimology, infrastructure, and tooling; publicly linked by Recorded Future to PLA Unit 69010.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.