Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · RedEcho · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

RedEcho

MITRE G1042 ↗

RedEcho — ATT&CK roseRE

attack rose · 5 techniques across 2 tactics

Analyst brief

misp-galaxy + mitre-attack

RedEcho: The group made heavy use of AXIOMATICASYMPTOTE — a term we use to track infrastructure that comprises ShadowPad C2s, which is shared between several Chinese threat activity groups

Kill chain

MITRE ATT&CK Enterprise · tap a technique

5 techniques · 2 of 15 tactics

  1. Resource development

    1 technique

  2. Command and control

    4 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
ShadowPadS0596 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

5 sources
  1. 1.recordedfuture.com/redecho-targeting-indian-power-sector
  2. 2.therecord.media/redecho-group-parks-domains-after-public-exposure
  3. 3.attack.mitre.org/groups/G1042
  4. 4.go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf
  5. 5.go.recordedfuture.com/hubfs/reports/ta-2022-0406.pdf

Track RedEcho on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.