Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Recorded Future’s Insikt Group documents RedDelta (a Chinese state‑sponsored APT) conducting targeted espionage across Mongolia, Taiwan, Myanmar, Vietnam, Cambodia and other countries from July 2023–Dec 2024. The group evolved its infection chain—using LNK, MSC, and HTML landing pages to stage MSI installers that deploy Nim-based loaders and a customized PlugX backdoor via DLL search-order hijacking—while proxying C2 through Cloudflare (including geofencing). The report includes confirmed compromises (e.g., Mongolian Ministry of Defense), detailed IoCs (domains, IPs, hashes), detection rules (YARA/Sigma), persistence/TTP mappings, and mitigations.