Red Menshen
Aliases: Red Dev 18, Earth Bluecrow
- First seen
- 2021-01-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 11:48:10
Targeted industries: technology-and-telecommunications government-and-public-sector education-and-nonprofits transportation-and-logistics
Targeted regions: country_code:cn country_code:tw
Context
Since 2021, Red Menshen, a China based threat actor, which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors using a custom backdoor referred as BPFDoor. This threat actor uses a variety of tools in its post-exploitation phase. This includes custom variants of the shared tool Mangzamel (including Golang variants), custom variants of Gh0st, and open source tools like Mimikatz and Metasploit to aid in its lateral movement across Windows systems. Also, They have been seen sending commands to BPFDoor victims via Virtual Privat Servers (VPSs) hosted at a well-known provider, and that these VPSs, in turn, are administered via compromised routers based in Taiwan, which the threat actor uses as VPN tunnels. Most Red Menshen activity that has been observed took place between Monday to Friday (with none observed on the weekends), with most communication taking place between 01:00 and 10:00 UTC.131 This pattern suggests a consistent 8 to 9-hour activity window for the threat actor, with realistic probability of it aligning to local working hours.
Reports & references
- pwc.com — Yir Cyber Threats Report Download (report)
- pwc.com — Yir Cyber Threats Annex Download (report)
- troopers.de — 7Cv8Pz (report)
- Trend Micro — Bpfdoor Hidden Controller (report)