File · Scarlet Mimic · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 1 techniques across 1 tactics
What changed
ledger · newest first- —todaynew CVE5 new CVEs: CVE-2009-3129, CVE-2010-2572, CVE-2010-2883, CVE-2010-3333, CVE-2012-0158
Analyst brief
misp-galaxy + mitre-attackScarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group’s motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, APT 2, it has not been concluded that the groups are the same.
The attacks began over four years ago and their targeting pattern suggests that this adversary’s primary mission is to gather information about minority rights activists. We do not have evidence directly linking these attacks to a government source, but the information derived from these activities supports an assessment that a group or groups with motivations similar to the stated position of the Chinese government in relation to these targets is involved. The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes.
Both the Tibetan community and the Uyghurs, a Turkic Muslim minority residing primarily in northwest China, have been targets of multiple sophisticated attacks in the past decade. Both also have history of strained relationships with the government of the People’s Republic of China (PRC), though we do not have evidence that links Scarlet Mimic attacks to the PRC. Scarlet Mimic attacks have also been identified against government organizations in Russia and India, who are responsible for tracking activist and terrorist activities.
While we do not know the precise target of each of the Scarlet Mimic attacks, many of them align to the patterns described above.
Observed targets (as stated by the sources)
0 countries · 1 sectorsassessed origin · Chinaobserved targets · 0
sectors · 1
- Activists
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique1 techniques · 1 of 15 tactics
Stealth
1 technique
select a technique
Arsenal
4 malwareas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs Scarlet Mimic is cited as exploiting
none on KEV- CVE-2009-31292026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333 CVE-2010-2883 CVE-2010-2572 CVE-2009-3129”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333 CVE-2010-2883 CVE-2010-2572 CVE-2009-3129”
cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
- CVE-2010-25722026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333 CVE-2010-2883 CVE-2010-2572”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333 CVE-2010-2883 CVE-2010-2572”
cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
- CVE-2010-28832026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333 CVE-2010-2883”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333 CVE-2010-2883”
cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
- CVE-2010-33332026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158 CVE-2010-3333”
cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
- CVE-2012-01582026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
“We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158”
cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
6 sources- 1.attack.mitre.org/wiki/Groups
- 2.unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-ac…
- 3.attack.mitre.org/groups/G0029
- 4.unit42.paloaltonetworks.com/atoms/golfing-taurus
- 5.attack.mitre.org/groups/G0029
- 6.researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-min…
Track Scarlet Mimic on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.