RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting Global Humanitarian, Think Tank, and Government Organizations

This Threat Analysis by Recorded Future's Insikt Group documents RedAlpha, a likely Chinese state-sponsored actor, conducting multi-year credential-theft campaigns against humanitarian and government organizations worldwide, using mass infrastructure, typosquatting domains, and credential-phishing pages impersonating trusted services, with notable focus on Taiwan and a potential link to private contractor activity, and it provides mitigations.