RedNovember targets exposed edge devices

RedNovember, also tracked as Storm-2077, is a suspected Chinese state-sponsored espionage operation that targets internet-facing perimeter appliances and moves quickly after public vulnerability disclosures. Recorded Future says the activity ran from June 2024 through July 2025 and used exploit-driven access against exposed devices to reach governments and private-sector organizations. The campaign has been tied to earlier abuse of CVE-2024-24919 on Check Point systems and CVE-2024-3400 on Palo Alto Networks PAN-OS GlobalProtect, along with tooling such as LESLIELOADER, Pantegana, and Cobalt Strike. Reported and likely victims span Africa, Asia, North America, South America, and Oceania, with interest in defense and aerospace, space, and law organizations. The activity also includes reconnaissance in Taiwan tied to semiconductor research and a military airbase, showing interest in strategically sensitive infrastructure. Check Point released a fix for CVE-2024-24919, and the available evidence suggests defenders need to treat newly disclosed edge-device flaws as immediate attack enablers, but the full extent of compromise remains unquantified.