Red Menshen is a China-based cyber espionage group that has been active since at least 2021, operating with a primary motivation of high-level espionage and strategic intelligence collection. The group is also known by the aliases Earth Bluecrow, Red Dev 18, and DecisiveArchitect. A distinguishing characteristic of Red Menshen is its deployment of highly stealthy "digital sleeper cells" and kernel-level implants, most notably the BPFDoor backdoor, to establish long-term persistence within targeted telecommunications networks. BPFDoor uniquely operates by passively monitoring network traffic for specially crafted "magic packets" rather than relying on conventional open ports or visible command-and-control channels, making its detection exceptionally challenging. The group exhibits a consistent operational cadence, with observed activities predominantly occurring on weekdays between 01:00 and 10:00 UTC, a pattern suggesting deliberate alignment with the local working hours of its targets

Aliases del actor

Earth BluecrowRed Dev 18

Actores similares

red-menshenactor · 1weredevilsactor · 1Red Dev 17apt · 0WeRedEvilsapt · 0redalertransomware · 2redransomwareransomware · 2Scattered Spideractor · 2redactactor · 2Scattered Lapsus$ Huntersthreat-actor · 1redcontroleactor · 1