Red Nue
Aliases: LuoYu
- First seen
- 2017-01-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 11:47:57
Targeted industries: government-and-public-sector media-and-entertainment technology-and-telecommunications
Targeted regions: country_code:cn
Context
Red Nue, active since at least 2017, is known for its use of the multi-platform LootRAt backdoor, also known as ReverseWindow. LootRAT has variants for Windows and Macintosh (reported in open source as Demsty), as well as an Android variant known as SpyDealer. Red Nue has also used another Windows backdoor known as WinDealer since at least 2019, when it deployed it to targets as part of a watering hole campaign on a Chinese news website for the Chinese diaspora community. Parts of Asia feature heavily in Red Nue's victimology.
Reports & references
- pwc.com — Yir Cyber Threats Report Download (report)
- pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
- jsac.jpcert.or.jp — Jsac2021 301 Shui Leon En (report)
- blogs.jpcert.or.jp — Windealer (report)
- Kaspersky — 105946 (report)
- blogs.blackberry.com — Threat Thursday China Based Apt Plays Auto Updater Card To Deliver Windealer Malware (report)