RedEcho

Summary

China-linked activity group (MITRE G1042) that Recorded Future's Insikt Group named in February 2021 after seeing, from mid-2020, a sharp rise in traffic from India's power sector to the ShadowPad-linked AXIOMATICASYMPTOTE infrastructure. Insikt identified 10 Indian power-sector organisations as suspected victims, including 4 of the 5 Regional Load Despatch Centres, and 2 seaports, and judged the activity a possible pre-positioning effort amid the 2020 India–China border tensions. It overlaps APT41/Barium and Tonto Team in infrastructure and victims, and ShadowPad is shared by at least five Chinese groups, so Insikt tracks it as a distinct group. Tradecraft: domains spoofing Indian critical-infrastructure entities (T1583.001), dynamic DNS (T1568), and SSL and HTTP C2 over 443 and non-standard ports such as 8080 (T1573.002, T1071.001, T1571).

Attribution

Insikt tracks it as distinct from, but overlapping, APT41 and Tonto Team

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-07-31)
  A People's Republic of China-related actor
• Recorded Future Insikt Group (Research, 2021-02-28)
  Overlaps Chinese groups APT41/Barium and Tonto Team; not firmly attributed to either

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 5

Infrastructure patterns

• ShadowPad C2 in the AXIOMATICASYMPTOTE server cluster, shared with other Chinese groups (Recorded Future, 2021)
• Domains spoofing Indian power-sector entities, e.g. ntpc-co[.]com (Insikt 2021)

Reporting and advisories 2

• MITRE ATT&CK
  G1042 — RedEcho
• Recorded Future Insikt Group
  China-linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions (Feb 2021)