Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

Red Nue

Red Nue is a China-attributed threat actor group, tracked by Brandefense.

Also known as
  • LuoYu
Request IOC feedRequest ATT&CK export
Origin
China
Techniques
0
Exploited CVEs
No CVE data
First seen
Jan 1, 2017
Record updated

About Red Nue.

Red Nue, active since at least 2017, is known for its use of the multi-platform LootRAt backdoor, also known as ReverseWindow. LootRAT has variants for Windows and Macintosh (reported in open source as Demsty), as well as an Android variant known as SpyDealer. Red Nue has also used another Windows backdoor known as WinDealer since at least 2019, when it deployed it to targets as part of a watering hole campaign on a Chinese news website for the Chinese diaspora community. Parts of Asia feature heavily in Red Nue's victimology.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.