Red Heron
Reports
3
First seen
Sep 14, 2026
Last seen
Oct 13, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1041 Exfiltration Over C2 Channel ×3T1190 Exploit Public-Facing Application ×3T1005 Data from Local System ×3T1562 Impair Defenses ×2T1059 Command and Scripting Interpreter ×2T1003 OS Credential Dumping ×2T1021.001 Remote Services: Remote Desktop Protocol ×1T1505.003 Web Shell ×1T1021 Remote Services ×1T1007 System Service Discovery ×1T1070 Indicator Removal ×1T1110 Brute Force ×1
Indicators
cve ×38domain ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-60004 (exploited)CVE-2026-60137 (exploited)CVE-2026-63030 (exploited)CVE-2022-0847 (exploited)CVE-2023-54391 (exploited)CVE-2021-38003 (exploited)CVE-2021-43798 (exploited)CVE-2021-44228 (exploited)CVE-2022-22965 (exploited)CVE-2024-4956 (exploited)CVE-2026-20079 (exploited)CVE-2026-20316 (exploited)CVE-2026-34908 (exploited)CVE-2026-34909 (exploited)CVE-2026-34910 (exploited)CVE-2026-35273 (exploited)CVE-2026-51990 (exploited)CVE-2026-54569 (exploited)CVE-2026-56271 (exploited)CVE-2026-7273 (exploited)
Recent reports
Critical