In September 2022, attendees at the inaugural @labscon_io heard about an actor I described then as "one of the most prolific, most deeply connected, and most technically advanced actors around". Events this week were a reminder that the video never went out, so here it is 👇
Information contained in the recent leaks overlaps directly with the actor we track as Red Scylla, plus a few adjacent clusters, such as DeepCliff and Poison Carp, which I talk about here, along with their use of #plugx, #winnti & #shadowpad: #threatintelsentinelone.com/labs/labscon-r…
"There is literally no threat actor we track in 2022 that appears to have a more global remit". We attributed intrusions in at least 35 countries to Red Scylla. @bkMSFT nailed it here:
https://x.com/bkMSFT/status/1759553787109285939
Leaked information also validates the same set of sectors we often saw them target, with a big focus on telecommunications:
The Chengdu scene is one of the most well established and historic locations of the infosec scene - it's no surprise that many founders have shared 15+ years of relationships.
These relationships, technical indicators, and related public reporting from @TrendMicroRSRCH @RecordedFuture and others, drew many links to i-Soon, and painted a picture of them as one of the most pervasive, capable China-based actors in recent history.
@TrendMicroRSRCH @RecordedFuture Direct video link:
• • •
Missing some Tweet in this thread? You can try to
force a refresh
