Back Despite Disruption: RedDelta Resumes Operations

The report documents RedDelta, a Chinese state-sponsored threat actor, resuming and expanding its cyberespionage activities using PlugX malware and DLL side-loading against Vatican-related targets, Hong Kong Catholic Diocese mail servers, Myanmar government systems, and Hong Kong universities, with decoy documents themed around Catholicism, Tibet-Ladakh, and UN topics; it describes reused public infrastructure, new C2 domains, a timeline of activity, associated malware artifacts, and recommended mitigations and outlook.