# Red Dev 17: threat group profile

> Red Dev 17 is a threat group thought to operate from China. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.precursorintelligence.com/threat-actors/red-dev-17
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > Red Dev 17

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 1 |
| Thought to operate from | China |
| Other names | 0 |
| Public reports | 2 |

## Who is Red Dev 17?

Red Dev 17 is a threat group thought to operate from China. Public reporting about it is still limited.

### What public reporting says

> In 2021, PwC started tracking a series of intrusions under the moniker of Red Dev 17 that they assess were highly likely conducted by a China-based threat actor. Their analysis suggests Red Dev 17 has been active since at least 2017. Red Dev 17's observed targets are mainly in India, and include the Indian military, a multinational India-based technology company, and a state energy company. They assess that it is highly probable that the threat actor behind intrusions associated with Red Dev 17 is also responsible for the campaign known in open source as Operation NightScout. Red Dev 17 is a user of the 8.t document weaponisation framework (also known as RoyalRoad), and abuses benign utilities such as Logitech or Windows Defender binaries to sideload and execute Chinoxy or PoisonIvy variants on victim systems. They identified capability and infrastructure links between Red Dev 17 and the threat actor they call Red Hariasa (aka FunnyDream APT), as well as infrastructure overlaps with Red Wendigo (aka Icefog, RedFoxtrot), and with ShadowPad C2 servers. At this time, they do not have sufficient evidence to directly link Red Dev 17 to any of these threat actors. However, They assess with realistic probability that Red Dev 17 operates within a cluster of threat actors that share tools and infrastructure, as well as a strong targeting focus on Southeast Asia and Central Asia.

## Who does Red Dev 17 go after?

**Sectors:** High-Tech, Military, Energy

**Countries and victims named:** India

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about Red Dev 17

- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
- https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/

## Frequently asked questions

### Who is Red Dev 17?

Red Dev 17 is a threat group thought to operate from China. Public reporting about it is still limited.

### Where is Red Dev 17 thought to be based?

Public reporting places Red Dev 17 as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Red Dev 17 target?

In public reporting, sectors named include high-tech, military and energy, and 1 countries and victims are named, including India.

### How do I know if Red Dev 17 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact