RedAlpha
RedAlpha is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government sector in 6 countries, including India and Thailand.
- DeepCliff
- Red Dev 3
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2015
- Record updated
Who They Target.
About RedAlpha.
The original research from Citizen Lab did not give this group a name. The campaigns, which we are collectively naming RedAlpha, combine light reconnaissance, selective targeting, and diverse malicious tooling. We discovered this activity as the result of pivoting off of a new malware sample observed targeting the Tibetan community based in India. Insikt Group’s analysis of infrastructure overlap among the new campaigns reveals wider targeting of the Chinese “Five Poisons,” in addition to South and Southeast Asian governments. Based on the campaign’s targeting of “Five Poisons”-related organizations, overlapping infrastructure, and links to malware used by other Chinese APTs uncovered during our research, we assess with medium confidence that the RedAlpha campaigns were conducted by a Chinese APT. Infrastructure overlaps have been found with 'APT 17, Deputy Dog, Elderwood, Sneaky Panda', 'Icefog, Dagger Panda' and 'NetTraveler, APT 21, Hammer Panda'.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.