RedLeaves

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.redleaves

Threat Analysis

RedLeaves is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://blog.jpcert.or.jp/.s/2017/04/redleaves---malware-based-on-open-source-rat.html

→http://blog.macnica.net/blog/2017/12/post-8c22.html

→http://go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf

→https://blogs.jpcert.or.jp/en/2017/04/redleaves---malware-based-on-open-source-rat.html

→https://community.rsa.com/community/products/netwitness/blog/2017/05/03/hunting-pack-use-case-redleaves-malware

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

BUGJUICEwin.redleavesRedLeaves

External Intelligence

Malpedia: win.redleaves

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search RedLeaves