“RDStealer”, a new custom malware written in Golang, has been observed in a highly targeted cyber campaign tracked as “RedClouds”, which has been ongoing since early 2022. This campaign has been targeting an East Asian company and has the goal of data exfiltration and credential theft. The campaign has yet to be attributed to a specific threat group, though researchers noted that the target aligns with “the interest of China-based threat actors” and has the sophistication of a state-sponsored actor. RDStealer is described as a server-side implant that takes advantage of the redirection feature in remote desktop servers. RDStealer monitors incoming remote desktop protocol (RDP) connections with client drive mapping enabled and, once clients are connected, infects them with the “Logutil” backdoor, and an additional custom malware, as well as exfiltrates sensitive information. The five modules of RDStealer are “a keylogger, a persistence establisher, a data theft and exfiltration staging module, a clipboard content capturing tool, and one controlling encryption/decryption functions, logging, and file manipulation utilities.” CTIX analysts urge administrators to review the additional technical details of the campaign’s attack chain found in the linked research paper and incorporate the indicators of compromise (IOCs) into their ongoing monitoring strategy.