Redalpha

RedAlpha, also known as DeepCliff, is an advanced persistent threat (APT) group that has been linked to Chinese state-sponsored cyber espionage activities. The group is known for its spyware campaigns against Tibetan minorities and has been identified in association with other threat groups such as RedHotel, Poison Carp, and a private contractor named iSoon. Analysis of leaked data from iSoon by researchers at Recorded Future revealed connections between these entities, indicating a complex network of operations involved in malicious activities like the theft of telecommunications data for tracking individuals. The connection between RedAlpha and iSoon became particularly evident through a credential phishing infrastructure used by both entities. Additional ties were discovered between iSoon and a persona named Liang Guodong, previously linked to RedAlpha, who was found to be registering credential phishing domains. This overlap in malware and tactics suggests a cooperative relationship between these threat actors, enhancing their collective capabilities and reach. Following the public exposure of the iSoon leak, significant changes have been observed in the infrastructure developed by RedAlpha and RedHotel, according to reports from Information Security Media Group. Notably, the Insikt Group has identified new domain and infrastructure developments from both RedAlpha and RedHotel since the leak. This highlights the adaptability of these groups in response to increased scrutiny and the ongoing threat they pose to cybersecurity.