RedDelta Modified PlugX Infection Chain Operations
Campaign · ATTACK:enterprise:C0047
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0047",
"title": "RedDelta Modified PlugX Infection Chain Operations",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0047",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--276671b5-5425-48db-ad65-c8c2564a969b",
"external_id": "C0047",
"domain": "enterprise",
"created": "2025-01-14T22:38:27.986Z",
"modified": "2026-07-31T18:47:18.644Z",
"version": "1.0",
"aliases": [
"RedDelta Modified PlugX Infection Chain Operations"
],
"tactics": [
],
"source_references": [
{
"source_name": "Recorded Future RedDelta 2025",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0381e557-6c8d-45c5-b390-f7909f782d3f
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d8f1592-92ba-4707-a814-465d37d808f3
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b1223a8-f8a4-46a9-af36-d71bfc6072b8
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c401eba-48ed-4daa-a123-6b4752c84026
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f3caa29-45d7-4ae7-b407-c5a4cccb3998
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:S0596
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22c2e565-d3f8-42e6-aa87-03427432dc89
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--325c0731-f5a7-42f5-8f2a-56358613895b
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c6ad797-8dba-4dee-8930-d35e26a782da
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--472d44d4-2297-4a39-b719-c5e044926726
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50ee9427-67e7-4db4-b931-1b872cd73e86
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--618b419c-d8a1-42cb-a846-ea465bd96618
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → attributed-to → ATTACK:enterprise:G0129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88015217-a3df-4654-bea1-b1d8241b67ee
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e8c23a5-ca50-4c40-992e-7bd1491077e7
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--933278a3-45a6-4d1a-93e7-76124d9938f6
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e9798ed-5cb1-4997-9701-d6adefc1bdab
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a265eb6a-d7a1-4013-b070-ab96fb6cae3c
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2c57145-9e7c-4536-87f6-428c8219377e
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9085e04-4072-4bb9-b76e-5d5d7da43cfb
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9923513-b249-48bb-81da-8e58730855de
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0f22510-dda6-4937-8155-383a2924540f
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b509cd54-97dc-4d27-b632-bcae388e09e6
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfdc1a69-6bc6-4a73-a2f2-48e947d19895
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df780e2f-1618-4ce0-8a89-6ac073b57cc9
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1218.014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2443bd0-d421-4710-9375-81f55968729a
Recorded Future RedDelta 2025ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9a79b10-7ed6-40be-be49-693c530717b0
Recorded Future RedDelta 2025