RedDelta

RedDelta, also known as Bronze President, is a threat actor that has been conducting cyber-espionage attacks since 2014. It is one of the likely Ministry of State Security (MSS)-linked groups which include APT10, APT17, APT27, APT40, APT41, TAG-22, and RedBravo among others. The organization's activities show overlaps with other Chinese Advanced Persistent Threat (APT) actors like Earth Preta and Camaro Dragon, suggesting shared tactics, techniques, or infrastructure. The SmugX campaign, active since at least December 2022, shows significant overlap with previously reported activity by RedDelta and another Chinese APT group, Mustang Panda. Despite these correlations, there is insufficient evidence to definitively link the SmugX campaign to either group. The victimology and lure tactics employed in the SmugX campaign are highly correlated to those described in reports about RedDelta and Mustang Panda, further indicating possible connections. Researchers have found several similarities between the infrastructure used in the SmugX campaign and previous campaigns attributed to RedDelta and Mustang Panda, including similarities involving certificates and IP addresses. However, absolute links concerning this campaign, tracked as SmugX, to previous campaigns attributed to RedDelta and Mustang Panda could not be proven. This highlights the complex and often obfuscated nature of attributing cyber-espionage activities to specific threat actors.