Scarlet Mimic G0029

Overview 81 indicators

Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same.

Techniques 1 ATT&CK

Open in ATT&CK Navigator → or download the layer (1 techniques, layer 4.5)

• T1036.002 Right-to-Left Override

Software 4

• FakeM
• CallMe
• Psylo
• MobileOrder

Principal sources 3 reports

Ranked by how many of this actor's indicators each report brought in.

• 73researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion…
• 6github.com/kbandla/APTnotes/blob/master/2013/wp-fa…
• 3virustotal.com/gui/file/81f6b4d95e52ffe48aa39eb5b61989…

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• BLACKGEAR
  2 shared indicators

Timeline 81 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2024-11-30 2 domain, 1 ipv42 yrs ago

   virustotal.com/gui/file/81f6b4d95e52ffe48aa39eb5b61989…

   domain	uyghur.25u.com
   domain	uyghuri.mrface.com
   ipv4	153.148.120.217:920

   copy batch

2. 2021-06-19 5 domain5 yrs ago

   github.com/kbandla/APTnotes/blob/master/2013/wp-fa…

   apple12.co.cc

   avira.suroot.com

   endless.zapto.org

   freeavg.sites.net

   googmail.com

   copy batch

3. 2021-06-19 1 domain5 yrs ago

   researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion…

   yourturbe.org

   copy batch

4. 2021-01-05 4 domain5 yrs ago

   researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion…

   angleegg.ddns.us

   angleegg.xxxy.info

   googmail.org

   gorlan.cloudns.pro

   copy batch

5. 2017-04-12 65 domain, 1 ipv49 yrs ago

   researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion…

   domain	aaa123.spdns.de
   domain	account.websurprisemail.com
   domain	accounts.yourturbe.org
   domain	addi.apple.cloudns.org
   domain	addnow.zapto.org
   domain	admin.spdns.org
   domain	alma.apple.cloudns.org
   domain	apple.lenovositegroup.com
   domain	apple12.crabdance.com
   domain	bailee.alanna.cloudns.biz
   domain	bee.aoto.cloudns.org
   domain	bits.githubs.net
   domain	book.websurprisemail.com
   domain	clean.popqueen.cloudns.org
   domain	desk.websurprisemail.com
   domain	detail43.myfirewall.org
   domain	dolat.diyarpakzimin.com
   domain	dolat.websurprisemail.com
   domain	dolet.websurprisemail.com
   domain	economy.spdns.de
   domain	economy.spdns.eu
   domain	eemete.freetcp.com
   domain	email.googmail.org
   domain	firefox.spdns.de
   domain	firewallupdate.firewall-gateway.net
   domain	fish.seafood.cloudns.org
   domain	freeavg.sytes.net
   domain	freeonline.3d-game.com
   domain	ftp112.lenta.cloudns.pw
   domain	github.ignorelist.com
   domain	ibmcorp.slyip.com
   domain	intersecurity.firewall-gateway.com
   domain	islam.youtubesitegroup.com
   domain	kaspersky.firewall-gateway.net
   domain	kasperskysecurity.firewall-gateway.com
   domain	kissecurity.firewall-gateway.net
   domain	lemondtree.freetcp.com
   domain	liumingzhen.myftp.org
   domain	liumingzhen.zapto.org
   domain	mail.firewall-gateway.com
   domain	mareva.catherine.cloudns.us
   domain	mm.lenovositegroup.com
   domain	muslim.islamhood.net
   domain	n.popqueen.cloudns.org
   domain	news.firewall-gateway.com
   domain	news.googmail.org
   domain	oic-oci.3-a.net
   domain	opero.spdns.org
   domain	otcgk.border.cloudns.pw
   domain	p.klark.cloudns.in
   domain	polat.googmail.org
   domain	ppcc.vasilevich.cloudns.info
   domain	press.ufoneconference.com
   domain	qq.ufoneconference.com
   domain	qq.yourturbe.org
   domain	sisiow.slyip.com
   domain	sys.firewall-gateway.net
   domain	update.googmail.org
   domain	uprnd.flnet.org
   domain	video.googmail.org
   domain	vip.yahoo.cloudns.info
   domain	webmail.yourturbe.org
   domain	worldwildlife.effers.com
   domain	youturbe.co.cc
   domain	yycc.mrbonus.com
   ipv4	207.204.225.117

   copy batch

6. 2017-04-12 1 domain9 yrs ago

   researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion… · github.com/kbandla/APTnotes/blob/master/2013/wp-fa…

   zjhao.dtdns.net

   copy batch

7. 2016-02-23 1 domain10 yrs ago

   researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion…

   ziba.lenovositegroup.com

   copy batch

Further reading 4

• researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espion…
• attack.mitre.org/groups/G0029
• github.com/kbandla/APTnotes/blob/master/2013/wp-fa…
• virustotal.com/gui/file/81f6b4d95e52ffe48aa39eb5b61989…