Netskope Threat Labs

RedLeaves

ATP Sandbox Adv. Heuristics

Stats

First seen
May 2022
Last seen
October 2026

Also known as

Redleaves

MITRE ATT&CK techniques

17 techniques across 7 tactics.

TA0002 Execution

TA0003 Persistence

TA0005 Stealth

TA0006 Credential Access

  • T1555Credentials from Password Stores

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1033System Owner/User Discovery
  • T1049System Network Connections Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery

TA0009 Collection

TA0011 Command and Control

Associated groups

Alert name variants

Alert Name
Win32.Backdoor.Redleaves
Win32.Dropper.RedLeaves
Win32.Trojan.RedLeaves

Related families

PlugXKONNIQakBotEmpireInvisiMole