APT Profile – Red Menshen

Red Menshen is a China-linked advanced threat actor active since at least 2021, known for deploying highly stealthy “digital sleeper cells” within telecommunications networks. Its campaigns are designed to enable high-level espionage, including targeted intrusions into government networks. The group is assessed to be an APT conducting cyber espionage operations using custom-developed tools.

Alias:
Earth Bluecrow

Motivation:
Information Theft, Espionage

Targeted Industries:

Targeted Countries:
Egypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.

Target Technologies:
Windows, Operating Systems

Malware used by Red Menshen:
BPFDoor

Attack Flow Diagram of APT Threat Actor Red Menshen

Red Menshen’s Recent Campaign Highlights and Trends

Recent Campaign Highlights

Deployment of BPFDoor for Stealth Persistence
Recent campaigns consistently show Red Menshen leveraging BPFDoor, a Linux-based backdoor that operates at the kernel level using Berkeley Packet Filter (BPF) functionality. Unlike traditional malware, BPFDoor does not rely on open ports or standard command-and-control communication. Instead, it passively monitors network traffic and activates only upon receiving specially crafted packets. This approach enables highly covert persistence within compromised environments and significantly reduces the likelihood of detection.

Targeting of Telecommunications Infrastructure
Red Menshen continues to prioritize telecommunications providers as its primary target. By infiltrating telecom networks, the group gains access to large volumes of data traversing these systems, including communications and metadata associated with government entities and enterprises. This targeting reflects a strategic focus on high-value infrastructure that enables broad intelligence collection rather than isolated system compromise.

Exploitation of Network Edge Devices for Initial Access
Recent activity indicates the group frequently exploits vulnerabilities in internet-facing network devices, including VPN appliances, firewalls, and enterprise network equipment. These systems serve as entry points into internal environments, allowing the actor to establish footholds without relying heavily on user interaction-based techniques such as phishing.

Use of Multi-Stage Post-Exploitation Toolchains
Following initial compromise, Red Menshen deploys a combination of custom and publicly available tools to expand access and maintain control. Observed toolsets include reverse shells, credential harvesting utilities, and cross-platform frameworks that facilitate lateral movement and remote command execution. This modular approach enables flexible operations across both Linux and Windows environments.

Covert Command-and-Control Mechanisms
Instead of maintaining persistent outbound connections, Red Menshen utilizes packet-triggered activation mechanisms within BPFDoor to control infected systems. This eliminates the need for continuous beaconing and allows command execution only when required, making network-based detection significantly more challenging.

Long-Term Persistence Within Critical Networks
Campaign observations indicate that Red Menshen maintains extended dwell times within compromised environments. The group focuses on sustaining undetected access over long periods, enabling continuous intelligence collection rather than immediate exploitation or disruption.

Trends

Shift Toward Infrastructure-Level Espionage
Red Menshen demonstrates a clear shift from traditional endpoint-focused attacks to compromising core network infrastructure, particularly within the telecommunications sector. This enables the actor to access and monitor data at scale, affecting multiple downstream organizations simultaneously.

Emphasis on Stealth and Passive Operations
The group prioritizes low-noise operations, avoiding techniques that generate detectable traffic such as frequent command-and-control communication. Passive backdoors and covert activation mechanisms are central to their operational model.

Advanced Use of Network-Level Techniques
The use of BPF-based malware reflects a deep understanding of network traffic handling and low-level system operations. This allows Red Menshen to operate below traditional security monitoring layers, indicating a high level of technical sophistication.

Strategic Pre-Positioning for Intelligence Collection
Rather than conducting rapid or destructive attacks, Red Menshen focuses on pre-positioning within critical infrastructure. By maintaining persistent access, the group ensures it can collect intelligence continuously or leverage access when required.

Consistent Focus on High-Value Targets
The actor continues to prioritize sectors associated with sensitive communications and national-level data, particularly telecommunications. This consistent targeting pattern highlights a long-term intelligence-driven objective.

Final Assessment
Red Menshen’s recent campaigns highlight a mature and highly specialized espionage model centered on stealth, persistence, and infrastructure access. The group’s continued use of BPFDoor and focus on telecom networks demonstrate a strategic approach aimed at broad, long-term intelligence collection rather than immediate operational impact.

TTPs based on MITRE ATT&CK Framework