Threat Actor
RedGolf
- First Reported
- Jan 23, 2025
- Latest Reported
- Apr 17, 2025
Reported Context (3)
- The article attributes the server and open-directory infrastructure to RedGolf and describes overlap with APT41. Exposed Server Reveals RedGolf-Linked Fortinet Exploits and Shiseido Reconnaissance
- The article attributes the GhostWolf malicious infrastructure cluster to RedGolf/APT41. How SSL Certificate History Can Help Threat Hunters Map Malicious Infrastructure
- Tracked designation for the suspected Chinese state-sponsored actor associated with the reported KEYPLUG infrastructure; the article says attribution remains uncertain. TLS Certificate and JA4X Clues Link New Servers to Suspected GhostWolf Infrastructure
CVE (2)
Malware (3)
People (1)
Threat Actors (5)
MITRE ATT&CK (7)
Vendors (2)
Products (7)
Tools (12)
Industries (1)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.