Scarlet Mimic
Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--c5574ca0-d5a4-490a-b207-e4658e5fd1d7
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (1)
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO
Software & Tools (4)
CallMe is a Trojan designed to run on Apple OSX. It is based on a publicly available tool called Tiny SHell
FakeM is a shellcode-based Windows backdoor that has been used by [Scarlet Mimic](https://attack.mitre.org/
MobileOrder is a Trojan intended to compromise Android mobile devices. It has been used by [Scarlet Mimic](
Psylo is a shellcode-based Trojan that has been used by [Scarlet Mimic](https://attack.mitre.org/groups/G00
Explore this actor's full graph with Ninja Signal