RedLeaves

RedLeaves is a malicious software (malware) that has been utilized in cyber espionage campaigns for over five years, as reported by Trend Micro. This malware, which is known to infect Windows machines, operates as a remote access trojan (RAT), enabling unauthorized access and control over infected systems. RedLeaves shares significant similarities with other malware families, such as Trochilus and SprySOCKS, in terms of its command-and-control (C&C) structure and protocol. In particular, strings appearing in both Trochilus and RedLeaves were also found in the SOCKS component added to SprySOCKS. APT10, a notable cyber threat group, has been associated with the deployment of custom malware families including RedLeaves. Furthermore, Trend Micro's analysis confirmed that Earth Yako’s MirrorKey malware employs the same encryption routine used by APT10 malware families, including RedLeaves and ChChes. However, it's important to note that there is no conclusive evidence at this time linking RedLeaves exclusively to STONE PANDA, another cyber threat group. The C&C infrastructure of SprySOCKS bears striking resemblance to that used by threat actors in association with RedLeaves in their cyber espionage activities. The C&C server that SprySOCKS connects to exhibits major similarities to a server used in a campaign involving RedLeaves. Additionally, the structure of SprySOCKS's C&C protocol mirrors that of the RedLeaves backdoor. It's also worth noting that like SprySOCKS, RedLeaves was based on Trochilus, further highlighting the interconnected nature of these malware families.