Red Menshen is a threat actor active since 2021, known for using custom BPFDoor backdoor across the Middle East and Asia.
Analyst brief
Red Menshen (also tracked as Red Dev 18 and Earth Bluecrow) is a threat actor active since 2021, targeting telecommunications, government, education, and logistics sectors across the Middle East and Asia. They utilize a custom backdoor known as BPFDoor for initial access. For post-exploitation and lateral movement on Windows systems, the actor employs custom variants of Mangzamel (including Golang variants), Gh0st, and open-source tools such as Mimikatz and Metasploit. Defenders should monitor network traffic for anomalies related to BPFDoor command-and-control hosted on VPS providers, enhance detection rules against Mimikatz usage on endpoints, and remain vigilant for the misuse of Metasploit frameworks in their environments.
Red Menshen
Red Dev 18Earth Bluecrow
unknown
Since 2021, Red Menshen, a China based threat actor, which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors using a custom backdoor referred as BPFDoor. This threat actor uses a variety of tools in its post-exploitation phase. This includes custom variants of the shared tool Mangzamel (including Golang variants), custom variants of Gh0st, and open source tools like Mimikatz and Metasploit to aid in its lateral movement across Windows systems. Also, They have been seen sending commands to BPFDoor victims via Virtual Privat Servers (VPSs) hosted at a well-known provider, and that these VPSs, in turn, are administered via compromised routers based in Taiwan, which the threat actor uses as VPN tunnels. Most Red Menshen activity that has been observed took place between Monday to Friday (with none observed on the weekends), with most communication taking place between 01:00 and 10:00 UTC.131 This pattern suggests a consistent 8 to 9-hour activity window for the threat actor, with realistic probability of it aligning to local working hours.