Redgolf

RedGolf, a Chinese state-sponsored threat activity group, has been actively targeting Windows and Linux systems with the KEYPLUG backdoor. This group's activities have been closely associated with other threat groups including APT41, Wicked Panda, Bronze Atlas, and Barium. The first known use of the KEYPLUG backdoor by RedGolf was reported by Mandiant in attacks against various U.S. state government networks from May 2021 to February 2022. The group's activities were further confirmed by Recorded Future in March 2023, highlighting the group's persistent threat to cybersecurity. The RedGolf operations involve the use of GhostWolf infrastructure, which includes 42 IP addresses for KEYPLUG command-and-control. They also utilize PlugX and Cobalt Strike, tools commonly used amongst many Chinese state-sponsored threat groups. The employment of these tools is expected to continue given their feature set, ready availability, and the ability to obfuscate responsibility due to the number of other threat actors using these techniques. The group's Tactics, Techniques, and Procedures (TTPs) show significant overlaps with those of APT41 and BARIUM. In addition to KEYPLUG, RedGolf has been identified using Cobalt Strike, PlugX, and Dynamic DNS (DDNS) domains. The Insikt Group has identified a broader cluster of KEYPLUG samples and operational infrastructure used by RedGolf from at least 2021 to 2023. Public reporting confirms that RedGolf used a Linux version of the custom modular backdoor KEYPLUG to target US state government entities during 2021 and 2022. The group is likely to continue its cyberattacks using KEYPLUG malware and its derivatives via a range of hosting providers.