Redhotel

RedHotel is a prolific threat actor group, known for its espionage activities targeting organizations of interest to the Chinese government. The group has been active since at least 2019 and operates alongside other threat groups such as RedAlpha and Poison Carp. Researchers at Recorded Future have linked RedHotel to iSoon, a private contractor with ties to Chinese state hacking groups, through analysis of leaked iSoon data. This link signifies a sophisticated network of espionage operations, including the theft of telecommunications data for tracking individuals. The iSoon leak has garnered widespread media attention, leading to observable changes in the infrastructure developed by RedAlpha and RedHotel, according to Kelly from Information Security Media Group. Furthermore, the group appeared in 2,157 other domains, suggesting potential ties to RedHotel. Since the leak, Insikt Group has identified newly observed domain and infrastructure developments from iSoon-linked groups like RedAlpha and RedHotel, indicating the groups' adaptability and resilience in response to exposure. Victim organizations referenced in the iSoon leak showed significant overlap with historically identified RedHotel victims, including Nepal Telecom, the Ministry of Economy and Finance of Cambodia, and Thai government departments, among others. To mitigate the risk posed by RedHotel, Insikt recommends configuring intrusion detection systems, intrusion prevention systems, or other network defense mechanisms to alert for the external IP addresses and domains likely controlled by RedHotel. These should be followed by a review and necessary blocking if applicable. The use of complex malware like KTLVdoor, more intricate than tools typically used by China-backed cyber-espionage actors like Earth Lusca (aka RedHotel or TAG-22), further underscores the advanced capabilities of this threat actor.