With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Recorded Future's Insikt Group attributes extensive KEYPLUG backdoor activity and a GhostWolf infrastructure cluster to RedGolf (likely Chinese state‑sponsored, overlapping with APT41/BARIUM), documenting campaigns from 2021–2023 that targeted US state governments and multiple industry sectors. The report provides detailed malware sample hashes, C2 protocols and IPs, DDNS and domain tradecraft, Cobalt Strike and PlugX usage, hosting provider patterns, a full Appendix of IOCs, and recommended mitigations.