Signalis
sign in--:--:--UTC
Threat actors

Red Menshen

☆ pin
Also known as Earth Bluecrow, DecisiveArchitect, Red Dev 18
Reports
3
First seen
Apr 1, 2026
Last seen
Oct 6, 2026
Motivation
Espionage

Relationships

CVE-2023-2868, in 1 of Red Menshen's report, exploited in the wildCVE-2023-2868CVE-2023-7102, in 1 of Red Menshen's report, exploited in the wildCVE-2023-7102Reports targeting TelecommunicationsTelecommunicationsReports targeting OtherOtherRed Menshen

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Telecommunications ×2Other ×1
Victim regions
South Korea ×1

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×2T1040 Network Sniffing ×1T1566 Phishing ×1T1070.001 Clear Windows Event Logs ×1T1021.004 Remote Services: SSH ×1T1078 Valid Accounts ×1T1071.001 Application Layer Protocol: Web Protocols ×1T1557 Man-in-the-Middle ×1T1190 Exploit Public-Facing Application ×1T1555 Credentials from Password Stores ×1T1090 Proxy ×1T1036 Masquerading ×1

Indicators

cve ×4domain ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2023-2868 (exploited)CVE-2023-7102 (exploited)CVE-2026-22719 (exploited)CVE-2026-33017 (exploited)

Recent reports

High

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

The Hacker NewsHigh

South Korea fines KT Corporation $39 million for 11-month data breach and undisclosed malware infection

Bleeping ComputerHigh

CERT-EU Cyber Brief March 2026 – Espionage, Supply-Chain Attacks, Iran Conflict Disruptions

CERT-EU Threat Intel

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans