RedEcho
RedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. RedEcho overlaps with various other PRC-linked threat groups, such as APT41, and is linked to ShadowPad malware use through shared infrastructure.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--2c40f629-6cf9-4f75-af32-9a98caec24ae
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:28+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (5)
Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achie
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with exi
Software & Tools (1)
ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang sof
Explore this actor's full graph with Ninja Signal