HOMETHREATSREDSHAWL
APT / THREAT GROUP

REDSHAWL

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

REDSHAWL is a session hijacking utility that starts a new process as another user currently logged on to the same system via command-line.

Threat Analysis

REDSHAWL is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://content.fireeye.com/apt/rpt-apt38
→https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf
→https://securelist.com/lazarus-under-the-hood/77908/
→https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

REDSHAWLwin.redshawl

External Intelligence

Malpedia: win.redshawl

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search REDSHAWL