RedHotel, also known as Charcoal Typhoon by Microsoft, is a state-sponsored hacking group affiliated with China’s Ministry of State Security. The threat group has targeted organizations globally across a wide range of industry verticals using a range of malware for both economic espionage and intelligence gathering campaigns. Notably, the group has targeted up to seventeen (17) countries, a majority of which are located across Southeast Asia, as well as the United States. Victims have primarily included countries’ local governments, including prime ministers’ offices, finance ministries, legislative bodies, and interior ministries. Additionally, RedHotel has been seen targeting technology R&D and historically COVID-19 research, as well as targeting other sectors including academia, aerospace, media, technology, and telecommunications. The group has used malware variants commonly used by other Chinese advanced persistent threat (APT) groups like ShadowPad and Winnti, helping them blend in and making attribution more difficult. However, the group’s distinct infrastructure and high operational tempo, on top of the wider use of both custom and offensive security tools, has helped differentiate their operations from other likely Chinese state-sponsored groups’.