Scarlet Mimic
MITRE ATT&CK: G0029 View on attack.mitre.org
Aliases: Golfing Taurus, Scarlet Mimic
- First seen
- 2011-01-01 00:00:00
- Origin
- CN
- Primary motivation
- ideology
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- nation-state, hacktivist
- Profile updated
- 2026-07-07 12:31:20
Targeted industries: education-and-nonprofits government-and-public-sector media-and-entertainment
Targeted regions: country_code:cn
Context
Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same.
Detection coverage
- 3 Sigma rules
Malware & tools used
- Right-to-Left Override (attack-pattern)
- MobileOrder (malware)
- FakeM (malware)
- CallMe (malware)
- Psylo (malware)
Reports & references
- MITRE ATT&CK — Groups (report)
- Palo Alto Unit 42 — Scarlet Mimic Years Long Espionage Targets Minority Activists (report)
- MITRE ATT&CK — G0029 (report)
- Palo Alto Unit 42 — Golfing Taurus (report)
- researchcenter.paloaltonetworks.com — Scarlet Mimic Years Long Espionage Targets Minority Activists (report)