Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

REF2924

REF2924 is a China-attributed threat actor group, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Origin
China
Techniques
0
Exploited CVEs
No CVE data
Record updated

About REF2924.

A group monitored as REF2924 by Elastic Security Labs is wielding novel data-stealing malware, an HTTP listener written in C# dubbed Naplistener by the researchers, in attacks against victims operating in southern and southeast Asia.According to a blog post by Elastic senior security research engineer Remco Sprooten, in that region of the world, network-based detection and prevention technologies are the de facto method for securing many environments.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.