RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

New Insikt Group research examines RedHotel, a Chinese state-sponsored threat activity group that stands out due to its persistence, operational intensity, and global reach. RedHotel's operations span 17 countries in Asia, Europe, and North America from 2021 to 2023. Its targets encompass academia, aerospace, government, media, telecommunications, and research sectors. Particularly focused on Southeast Asia's governments and private companies in specified sectors, RedHotel's infrastructure for malware command-and-control, reconnaissance, and exploitation points to administration in Chengdu, China. Its methods align with other contractor groups linked to China's Ministry of State Security (MSS), indicating a nexus of cyber talent and operations in Chengdu.

Schematic of RedHotel’s multi-tiered C2 infrastructure network

RedHotel has a dual mission of intelligence gathering and economic espionage. It targets both government entities for traditional intelligence and organizations involved in COVID-19 research and technology R&D. Notably, it compromised a US state legislature in 2022, highlighting its expanded reach. RedHotel employs a multi-tiered infrastructure with a distinct focus on reconnaissance and long-term network access via command-and-control servers.

Since at least 2019, RedHotel has exemplified a relentless scope and scale of wider PRC state-sponsored cyber-espionage activity by maintaining a high operational tempo and targeting public and private sector organizations globally. The group often utilizes a mix of offensive security tools, shared capabilities, and bespoke tooling.

Recorded Future's Insikt Group observes various Chinese state-sponsored cyber threats, with RedHotel standing out for its broad scope and intensity of activity. RedHotel's campaigns include innovations such as exploiting a stolen code signing certificate and commandeering Vietnamese government infrastructure. Despite public exposure, RedHotel's bold approach suggests it will persist in its activities.

To read the entire analysis with endnotes, click here to download the report as a PDF.

Appendix A — Indicators of Compromise

Domains: dga[.]asia kb.dga[.]asia video.dga[.]asia sc.dga[.]asia dgti.dga[.]asia nhqdc[.]com msdn.microsoft.nhqdc[.]com icoreemail[.]com demo.icoreemail[.]com officesuport[.]com kiwi.officesuport[.]com cdn.officesuport[.]com test.officesuport[.]com mail.officesuport[.]com ntpc.officesuport[.]com main.officesuport[.]com excel.officesuport[.]com remote.officesuport[.]com ismtrsn[.]club lrm.ismtrsn[.]club tgoomh.ismtrsn[.]club news.ismtrsn[.]club icarln.ismtrsn[.]club liveonlin[.]com npgsql.liveonlin[.]com public.liveonlin[.]com tech.liveonlin[.]com main.liveonlin[.]com cctv.liveonlin[.]com alexa-api[.]com www.alexa-api[.]com ngndc[.]com air.ngndc[.]com spa.ngndc[.]com mkn.ngndc[.]com ekaldhfl[.]club ts.ekaldhfl[.]club ist.ekaldhfl[.]club downloads.ekaldhfl[.]club pps.ekaldhfl[.]club plt.ekaldhfl[.]club tlt.ekaldhfl[.]club thy.ekaldhfl[.]club us.ekaldhfl[.]club asia-cdn[.]asia report.asia-cdn[.]asia freehighways[.]com map.freehighways[.]com iredemail[.]com index.iredemail[.]com demo.iredemail[.]com open.iredemail[.]com api.iredemail[.]com full.iredemail[.]com bbs.iredemail[.]com 0nenote[.]com keep.0nenote[.]com asia-cdn[.]asia api.asia-cdn[.]asia speedtest.asia-cdn[.]asia cyberoams[.]com checkip.cyberoams[.]com ekaldhfl[.]club pps.ekaldhfl[.]club usa.ekaldhfl[.]club mtlklabs[.]co conhostsadas[.]website itcom666[.]live qbxlwr4nkq[.]itcom666[.]live 8kmobvy5o[.]itcom666[.]live itcom888[.]live bwlgrafana[.]itcom888[.]live itsm-uat-app[.]itcom888[.]live dkxvb0mf[.]itcom888[.]live nvw3tdetwx[.]itcom888[.]live 0j10u9wi[.]itcom888[.]live yt-sslvpn[.]itcom888[.]live vappvcsa[.]itcom888[.]live 94ceaugp[.]itcom888[.]live sibersystems[.]xyz fyalluw0[.]sibersystems[.]xyz sijqlfnbes.sibersystems[.]xyz jmz8xhxen3.sibersystems[.]xyz 2h3cvvhgtf.sibersystems[.]xyz 3tgdtyfpt9.sibersystems[.]xyz n71qtqemam.sibersystems[.]xyz 711zm77cwq.sibersystems[.]xyz R77wu4s847.sibersystems[.]xyz caamanitoba[.]us jw7uvtodx4.caamanitoba[.]us xdryqrbe.caamanitoba[.]us b1k10pk9.caamanitoba[.]us 6hi6m62bzp.caamanitoba[.]us livehost[.]live sci.livehost[.]live C2 IP Addresses (seen May to June 2023) 1.13.82[.]101 5.188.33[.]188 5.188.33[.]254 5.188.34[.]164 5.188.34[.]173 38.54.16[.]131 38.54.16[.]179 38.60.199[.]87 38.60.199[.]208 45.76.186[.]26 45.77.153[.]197 61.238.103[.]165 64.227.132[.]226 92.38.169[.]222 92.38.176[.]128 92.38.178[.]40 92.38.178[.]60 92.223.90[.]133 95.85.91[.]50 103.140.239[.]41 103.157.142[.]95 108.61.158[.]179 139.180.193[.]182 140.82.7[.]72 141.164.63[.]244 154.212.129[.]132 156.236.114[.]202 TLS Certificate (SHA256 Fingerprints): f8cd64625f8964239dad1b2ce7372d7a293196455db7c6b5467f7770fd664a61 294fb8f21034475198c3320d01513cc9917629c6fd090af76ea0ff8911e0caa3 9c8e5f6e5e843767f0969770478e3ad449f8a412dad246a17ea69694233884b9 29ed44228ed4a9883194f7e910b2aac8e433ba3edd89596353995ba9b9107093 b02aed9a615b6dff2d48b1dd5d15d898d537033b2f6a5e9737d27b0e0817b30e Cobalt Strike Loaders 5cba27d29c89caf0c8a8d28b42a8f977f86c92c803d1e2c7386d60c0d8641285 48e81b1c5cc0005cc58b99cefe1b6087c841e952bb06db5a5a6441e92e40bed6 25da610be6acecfd71bbe3a4e88c09f31ad07bdd252eb30feeef9debd9667c51 233bb85dbeba69231533408501697695a66b7790e751925231d64bddf80bbf91 aeceaa7a806468766923a00e8c4eb48349f10d069464b53674eeb150e0a59123 Brute Ratel Loaders 6e3c3045bb9d0db4817ad0441ee3c95b8fe3e087388d1ceefb9ebbd2608aef16 6f31a4656afb8d9245b5b2f5a634ddfbdb9db3ca565d2c52aee68554ede068d1 c00991cfeafc055447d7553a14be2303e105b6a97ab35ecf820b9dbd42826f9d Winnti 5861584bb7fa46373c1b1f83b1e066a3d82e9c10ce87539ee1633ef0f567e743 69ff2f88c1f9007b80d591e9655cc61eaa4709ccd8b3aa6ec15e3aa46b9098bd 2f1321c6cf0bc3cf955e86692bfc4ba836f5580c8b1469ce35aa250c97f0076e f1dcf623a8f8f4b26fe54fb17c8597d6cc3f7066789daf47a5f1179bd7f7001a Spyder 7a61708f391a667c8bb91fcfd7392a328986059563d972960f8237a69e375d50 5d3a6f5bd0a72ee653c6bdad68275df730b836d6f9325ee57ec7d32997d5dcef 1ded9878f8680e1d91354cbb5ad8a6960efd6ddca2da157eb4c1ef0f0430fd5f e053ca5888fb0d5099efed76e68a1af0020aaaa34ca610e7a1ac0ae9ffe36f6e 24d4089f74672bc00c897a74664287fe14d63a9b78a8fe2bdbbf9b870b40d85c FunnySwitch 7056e9b69cc2fbc79ba7a492906bcc84dabc6ea95383dff3844dfde5278d9c7a ede0c1f0d6c3d982f63abbdd5f10648948a44e5fa0d948a89244a06abaf2ecfe 9eb0124d822d6b0fab6572b2a4445546e8029ad6bd490725015d49755b5845a4

Appendix B — Mitre ATT&CK Techniques

Tactic: Technique	ATT&CK Code	Observable
Reconnaissance: Active Scanning: Vulnerability Scanning	T1595.002	RedHotel has used vulnerability scanning tools such as Acunetix to scan externally facing appliances for vulnerabilities
Resource Development: Acquire Infrastructure: Domains	T1583.001	RedHotel has purchased domains, primarily via Namecheap.
Resource Development: Acquire Infrastructure: Virtual Private Server	T1583.003	RedHotel has provisioned actor-controlled VPS, with a preference for the providers Choopa (Vultr), G-Core, and Kaopu Cloud HK Limited.
Resource Development: Compromise Infrastructure: Server	T1584.004	RedHotel has also used compromised GlassFish servers as Cobalt Strike C2s and to scan target networks.
Initial Access: Exploit Public-Facing Application	T1190	RedHotel has exploited public-facing applications for initial access, including Zimbra Collaboration Suite (CVE-2022-24682, CVE-2022-27924, CVE-2022-27925 chained with CVE-2022-37042, and CVE-2022-30333), Microsoft Exchange (ProxyShell), and the Log4Shell vulnerability in Apache Log4J.
Initial Access: Spearphishing: Spearphishing Attachment	T1566.001	RedHotel has used archive spearphishing attachments containing shortcut (LNK) files which fetch remotely hosted scripts (HTA, VBScript). These scripts are then used to trigger DLL search order hijacking infection chains and display decoy documents to users.
Persistence: Server Software Component: Web Shell	T1505.003	RedHotel has used web shells within victim environments and to interact with compromised GlassFish servers
Persistence:: Scheduled Task/Job: Scheduled Task	T1053.005	RedHotel has used scheduled tasks for persistence for the group’s Spyder backdoor: C:\Windows\System32\schtasks.exe /RUN /TN PrintWorkflow_10e3b
Persistence: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	T1547.001	The ScatterBee ShadowPad loader persists via the Run registry key and also stores the encrypted ShadowPad payload in the registry.
Defense Evasion: Obfuscated Files or Information	T1027	RedHotel has used the tool ScatterBee to obfuscate ShadowPad payloads. The group has also repeatedly stored encrypted or encoded payloads within files named bin.config.
Defense Evasion: Deobfuscate/Decode Files or Information	T1140
Defense Evasion: Subvert Trust Controls: Code Signing	T1553.002	RedHotel has signed malicious binaries using stolen code signing certificates (such as the referenced WANIN International certificate).
Defense Evasion: Hijack Execution Flow: DLL Search Order Hijacking	T1574.001	RedHotel has abused multiple legitimate executables for DLL search order hijacking, including vfhost.exe, mcods.exe, and BDReinit.exe.
Defense Evasion: Masquerading: Match Legitimate Name or Location	T1036.005	RedHotel has used legitimate file names in tandem with DLL search order hijacking to load malicious DLLs.
Command and Control: Proxy: External Proxy	T1090.002	RedHotel has used VPS C2s to proxy traffic upstream to actor-controlled servers.
Command and Control: Application Layer Protocol: Web Protocols	T1071.001	RedHotel Brute Ratel and Cobalt Strike samples referenced within this report communicate over HTTPS.
Exfiltration: Exfiltration Over C2 Channel	T1041	RedHotel has exfiltrated data over malware C2 channels.