RedAlert
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2022-08-25
- Last seen
- 2022-08-25
- Updated
- 2026-10-07 02:37
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor tracked as N13V, also known as RedAlert, operates from Russia. It has been observed targeting government agencies in Latin America, exemplified by the August 2022 ransomware attack on Chile’s National Consumer Service (Sernac), which encrypted Windows and VMware ESXi systems and appended the .crypt extension. The actor’s typical tactics involve the RedAlert/N13V ransomware family, which performs double extortion by encrypting files and threatening to leak stolen data via a Tor‑based leak site. No specific initial‑access vectors or additional tooling are described in the source material. Public attribution places the actor in Russia, but no state sponsor or criminal‑consortium link is explicitly stated. The Sernac incident represents the actor’s most clearly documented operation to date.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.