Red Echo
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 4 incidents
- Sources
- 121 sources
- First seen
- 2020-10-12
- Last seen
- 2026-03-31
- Updated
- 2026-10-05 01:34
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Red Echo, also known as A41 and UNC1069, is a China-linked threat actor. It has conducted supply chain attacks, such as the 2026 compromise of a JavaScript library used in a GitHub Actions workflow to sign OpenAI’s macOS applications, which exposed a code‑signing certificate that was later revoked. The group has targeted critical infrastructure in India, including State Load Despatch Centres near the Ladakh border, a national emergency response system, a logistics firm, and power sector and maritime organizations in Mumbai, using ShadowPad malware, compromised DVR/IP camera devices for command‑and‑control, and the open‑source tool FastReverseProxy. These operations are described as pre‑positioning for future contingency operations or intelligence gathering on critical systems, and have been linked to China’s strategic interests and geopolitical tensions, including the Belt and Road Initiative.
Incidents
Attributed incidents are available to members.
4 incidentsSources
Sources available to members: 121 sources.