RedNovember

A China-linked espionage actor, previously tracked by Recorded Future as TAG-100 and overlapping with public reporting on Storm-2077. It exploits internet-facing appliances and uses tools such as Pantegana and Cobalt Strike against government, defense, aerospace, technology, and legal organizations.