Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionage

Redfly

Redfly is a nation-state APT group with an espionage motive, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2023-20198Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege…ExploitedcriticalCVE-2022-3236A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.ExploitedcriticalCVE-2023-48788Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.ExploitedcriticalCVE-2024-21887Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products…ExploitedcriticalCVE-2016-1646Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via…ExploitedhighCVE-2016-5198Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a…ExploitedhighCVE-2017-5030Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page.ExploitedhighCVE-2017-5070Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page.ExploitedhighCVE-2018-17463Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page.ExploitedhighCVE-2018-17480Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page.ExploitedhighCVE-2018-6065Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.ExploitedhighCVE-2020-6418Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.ExploitedhighCVE-2023-46805Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that…ExploitedhighCVE-2023-20273Cisco IOS XE contains a command injection vulnerability in the web user interface.ExploitedhighCVE-2023-3420Type Confusion in V8 in Google Chrome prior to allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.high

Arsenal · Malware And Tools.

  • ShadowPadmalware
  • ProcDumptool

About Redfly.

Redfly hacked a national electricity grid organization in Asia and maintained persistent access to the network for about six months. Researchers discovered evidence for this attack between 28 February and 3 August 2023 after noticing suspicious malware activity within the organization’s network.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.