Between July 2023 and December 2024, Insikt Group observed the Chinese state-sponsored group RedDelta targeting Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia with an adapted infection chain to distribute its customized PlugX backdoor. The group used lure documents themed around the 2024 Taiwanese presidential candidate Terry Gou, the Vietnamese National Holiday, flood protection in Mongolia, and meeting invitations, including an Association of Southeast Asian Nations (ASEAN) meeting. RedDelta likely compromised the Mongolian Ministry of Defense in August 2024 and the Communist Party of Vietnam in November 2024. The group conducted spearphishing targeting the Vietnamese Ministry of Public Security, but Insikt Group observed no evidence of successful compromise. From September to December 2024, RedDelta likely targeted victims in Malaysia, Japan, the United States, Ethiopia, Brazil, Australia, and India.

In late 2023, RedDelta evolved the first stage of its infection chain to leverage a Windows Shortcut (LNK) file likely delivered via spearphishing. In 2024, the group transitioned to using Microsoft Management Console Snap-In Control (MSC) files. Most recently, RedDelta used spearphishing links to prompt a victim to load an HTML file remotely hosted on Microsoft Azure. Since July 2023, RedDelta has consistently used the Cloudflare content distribution network (CDN) to proxy command-and-control (C2) traffic, which enables the group to blend in with legitimate CDN traffic and complicates victim identification. Other state-sponsored groups, including Russia’s BlueAlpha, have similarly leveraged Cloudflare to evade detection.

RedDelta’s activities align with Chinese strategic priorities, focusing on governments and diplomatic organizations in Southeast Asia, Mongolia, and Europe. The group’s Asia-focused targeting in 2023 and 2024 represents a return to the group’s historical focus after targeting European organizations in 2022. RedDelta’s targeting of Mongolia and Taiwan is consistent with the group’s past targeting of groups seen as threats to the Chinese Communist Party’s power.

About RedDelta:

RedDelta has been active since at least 2012 and has focused on targeting Southeast Asia and Mongolia. The group has routinely adapted its targeting in response to global geopolitical events. RedDelta targeted the Vatican and other Catholic organizations with PlugX before 2021 talks between China and the Vatican. The has group compromised law enforcement and government entities in India, a government organization in Indonesia, and other targets across Myanmar, Hong Kong, and Australia.

In 2022, RedDelta shifted toward increased targeting of European government and diplomatic entities following Russia's invasion of Ukraine. This activity used an infection chain that began by delivering an archive file (ZIP, RAR, or ISO), which was likely delivered via spearphishing. The file contained a Windows Shortcut (LNK) file disguised with a double extension (such as .doc.lnk) and a Microsoft Word icon. Hidden folders within the archive contained three files used to complete dynamic-link library (DLL) search order hijacking: a legitimate binary, a malicious DLL loader, and an encrypted PlugX payload that was ultimately loaded into memory. User execution of the Shortcut file led to DLL search order hijacking. In November 2022, RedDelta evolved its tactics to stage the ISO file on a threat actor-controlled domain.

In March 2023, Insikt Group identified RedDelta targeting Mongolia using a similar infection chain that started with a container file (RAR, ZIP, ISO) consisting of an LNK file that triggered a DLL search order hijacking triad located within a hidden nested subdirectory. Decoy documents included an invitation from the World Association of Mongolia and a document claiming to be a BBC news interview about Tibetan Buddhism and Mongolia. RedDelta targeted:

Members of multiple Mongolian non-governmental organizations (NGOs), including a human rights and pro-democracy NGO focused on the Inner Mongolia Autonomous Region

Mongolian Buddhist activists in Mongolia and Japan

Academic professionals in Mongolia and Japan

Developers of two Mongolian mobile applications

Mitigations:

To detect and mitigate RedDelta activity, organizations should:

Use YARA and Sigma rules provided by Insikt Group to detect RedDelta Windows Installer (MSI), DLL, and LNK files (see below).

Configure intrusion detection systems (IDS), intrusion prevention systems (IPS), and other network defense mechanisms to alert on or block connection attempts from external IP addresses and domains associated with RedDelta (see below).

Keep software and applications — particularly operating systems, antivirus software, and core system utilities — up to date.

Filter email correspondence and scrutinize attachments for malware.

Conduct regular system backups and store them offline and offsite to ensure they are inaccessible via the network.

Adhere to strict compartmentalization of company-sensitive data, institute role-based access, and limit company-wide data access.

Deploy client-based host logging and intrusion detection capabilities to identify and thwart attacks early.

Prevent threat actors from bypassing security by disabling outdated authentication methods.

Implement tools like network IDS, NetFlow collection, host logging, and web proxy, alongside manual monitoring of detection sources.

Practice network segmentation and ensure special protections exist for sensitive information, such as multifactor authentication, and restricted accesss.

Leverage the Recorded Future® Third-Party Intelligence module and Threat Intelligence Browser Extension for real-time monitoring and prioritized vulnerability patching.

Review public guidance (1, 2, 3, 4) and Insikt Group’s “Charting China’s Climb as a Leading Global Cyber Power” report for comprehensive recommendations for mitigating Chinese advanced persistent threat activity more broadly.

Outlook:

Insikt Group anticipates that RedDelta will continue targeting organizations worldwide with its customized PlugX backdoor, focusing on Southeast Asia and China’s periphery, including Mongolia and Taiwan. Likely targets include governments, NGOs, activists, and religious organizations. RedDelta has continually evolved its infection chain and is anticipated to continue doing so in the future in response to major geopolitical developments.

To read the entire analysis, click here to download the report as a PDF.

In response to the worsening flu and flu-like illness outbreak in Mongolia, the U.S. Military’s Civil Military Liaison Element and the U.S. Embassy donated 2000 pulse oximeters to the Ministry of Health. The oximeters are crucial tools to help doctors and nurses quickly evaluate and triage patients, which is especially needed as hospitals in Ulaanbaatar are facing capacity issues.

“The Ministry of Health would like to thank the United States Embassy and the U.S. Civil Military Support Element for donating this critical monitoring equipment. These pulse oximeters will help nurses and doctors in Ulaanbaatar and throughout the country better care for Mongolian’s seeking medical care this flu season. Ministry of Health Director General of Finance E. Munkhsukh”

The oximeters will be distributed by the Ministry of Health to public hospitals in and around Ulaanbaatar that are experiencing the most strain from the increase in flu patients. In addition to this equipment being critical to the care and treatment of flu and other respiratory virus patients, they will also increase Mongolia’s capacity to care for a variety of other illnesses.

The United States continues to stand by and support our Third Neighbor and glad this donation will be able to assist the Mongolian healthcare network in alleviating the stress and impact this winter illness season has on its citizens.

Source: U.S. Embassy in Mongolia

The Government of Mongolia has declared 2025 as the "Year to Support the Development of Infrastructure of Ulaanbaatar City" and intends to take immediate measures to solve the most pressing issues in Ulaanbaatar including air pollution and traffic congestion.

Prime Minister of Mongolia Oyun-Erdene Luvsannamsrai and members of the newly established Performance Monitoring Unit visited the eastern plant of the “Tavantolgoi Fuel” company on January 7, 2025.

As part of improving briquette technology, from March 1 this year the briquettes that use imported middling grade coal will be replaced with improved fuel produced from the top layer concentrate coal from the “Erdenes Tavantolgoi” company’s plant. According to tests comparing the current middling coal with the top layer concentrate coal, using the latter type resulted in a 33.7 percent decrease in particulate matter emissions, a 63.7 percent reduction in sulfur dioxide emission, and a 39 percent increase in carbon monoxide. In other words, the binding material for briquettes will be replaced, and a "green coal" product will be added to the sifted coal, improving the quality of the briquette fuel. The Mayor of Ulaanbaatar explained that standards for briquettes and binder material will be updated.

In addition, as instructed by the Prime Minister, a draft law on actions for air and environmental pollution reduction in Ulaanbaatar has been formulated and is to be submitted soon to the Government and the State Great Khural for approval. With the legal framework in place, all smoke generators, including 198 thousand stoves in ger districts, more than 500 thousand vehicles, more than 2,200 low-pressure boilers, 174 furnaces, and thermal power plants will be regulated. The implementation of the law will enable 30 percent of each source of emissions to switch to gas fuel annually, 1,300 buses in service to gas fuel, and the establishment of special regime zones in the capital city to reduce the negative impact of air and environmental pollution on society and economy, protect the health of citizens, and ensure the right to live in a healthy and safe environment.

Special regime zones are classified as green and yellow zones, and households in the green zone will be switched to liquefied gas fuel /LNG, LPG/ that meets standards. This zone is planned to cover about 202 thousand citizens from 50,189 households in 48,118 units of area. The green or chimney-free zone will be expanded and updated each time by the Governor of the Capital City. The regulations also include the restriction on environmental pollution emissions, for instance, prohibiting vehicles that emit air pollutants exceeding the permissible emission levels in the zone, and not selling gasoline and diesel fuel below Euro 5 standards.

The yellow zone is estimated to cover more than 147 thousand households, providing them with standard-compliant double-combustion stoves. The tender for the first round of 32 thousand stoves will be announced this month. In the future, a total of 95 thousand households will be involved in an insulation project and provided with standard-compliant double-combustion stoves.

CEO of “Erdenes Mongol” Narantsogt Sanjaa presented the "Blue Coal" project of the coal-pyrolysis plant, which is a part of the Coal and Chemical Complex to be built based on the Baganuur coal mine. This project is one of the Government’s 14 mega projects. The first part of the USD 190 million plant is planned to be put into operation in December of this year and fully completed in 2027. The “Blue Coal” project is estimated to reduce the capital's emissions by 60-80 percent and generate 100 MW of energy.

The Performance Monitoring Unit established under the Prime Minister will convene every Saturday.

A discussion on a draft law to ensure the efficient operation of state-owned enterprises was held on January 7, 2025, at the Mongolian National Chamber of Commerce and Industry (MNCCI).

Around 200 representatives from both the public and private sectors attended the legal discussion on the “Law on Increasing the Productivity and Improving the Governance of State- and Local-Government-Owned Companies,” which was jointly organized by the MNCCI and the Cabinet Secretariat of the Government of Mongolia. During the discussion, participants talked about reducing 122 state-owned enterprises to 70. Since state-owned enterprises must contribute to increasing the revenues of the Sovereign Wealth Fund, there should be no state-owned enterprises that generate no profit or operate at a loss. In the future, companies operating without profit will no longer be required to remain state-owned, emphasized Director of the Cabinet Secretariat Chairman Uchral Nyam-Osor.

Director of the Cabinet Secretariat Uchral stated, “By enacting a law that increases productivity and improves the governance of state-owned companies while ensuring transparency, we will reduce political influence. For many years, the criteria put forward by members of the boards of directors and executive directors have been unclear. Although the selection process was deemed open, in reality, it has rarely been so. Therefore, this law would make sure the entire selection process is fully transparent. We will also streamline the status of state-owned companies. Supplementing the new Budget Law, any state-owned entity that has incurred financial losses for three consecutive years will be immediately dissolved by law. Under this draft law on state-owned enterprises, only those companies that operate efficiently and profitably will remain state-owned. Others, operating without profit or at a loss, will be liquidated or merged as part of the reforms. The law will clearly define which businesses the state should engage in and which it should not. The state will participate in four types of business activities. After this law is enacted, based on its principles, we will submit the main policy guidelines for state-owned companies to the State Great Khural for approval.

We have also incorporated the core principle of not competing with the private sector. Currently, as of 2023, 122 state-owned companies have submitted their revenue information to the State Property Policy and Regulation Agency. In total, 51 entities reported profits of MNT 380 billion. Five entities collectively reported MNT 4 trillion in profits. Meanwhile, about five companies are unprofitable and operate at a loss. If state-owned enterprises become more profitable, the revenues of both the Savings Fund and the Sovereign Wealth Fund will increase. Whether state-owned enterprises operate profitably is directly linked to growing the revenues of the sovereign wealth fund. In order to increase their earnings, the governance of state-owned enterprises will be made more transparent and open.”

The number of livestock in Mongolia reached 57.6 million at the end of 2024, down 7 million or 10.9% compared to last year, the National Statistics Office reported.

The Office conducted livestock census from December 7 to December 17, 2024.

The number of livestock, excluding camels, decreased. In particular, the total number of horses was 4.7 million, cows 5.1 million, sheep 24.5 million, goats 22.9 million, while the number of camels was 480,600, an increase of 1.4%.

Khovsgol province is in the top five provinces in livestock numbers with a total of 5.2 million heads, followed by Uvurkhangai province with a total of 5.1 million heads, Tuv province with a total of 4.2 million heads, Arkhangai province with 4.1 million heads, and Bayankhongor province with 4.0 million heads.

Arkhangai province ranks first in the number of horses and cows, Omnogovi province in the number of camels, Uvurkhangai province in the number of sheep, and Bayankhongor province in the number of goats.

The Bank of Mongolia, the nation's central bank, procured a total of 16.5 tons of gold from legal entities and individuals throughout 2024, local media reported on Wednesday, citing an official statement from the bank.

This represents an approximate 8 percent decline compared to the previous year's gold purchases, the bank said.

Central banks globally hold gold as a key component of their foreign exchange reserves, and Mongolia is no exception.

Despite the reduction in gold acquisitions, the Asian country's foreign exchange reserves reached an all-time high of 5.5 billion U.S. dollars by the end of 2024, according to the Bank of Mongolia.

Horses are silent carriers of H5N1 bird flu, a new study from the University of Glasgow has found.

Testing of horses in Mongolia found that several had antibodies for H5N1, indicating prior infection. None of the animals had ever been reported as sick, however, meaning they can carry the virus asymptotically.

The findings raise concerns for people who live and work closely with horses and other equids – from American cowboys to Scottish crofters and their Shetland ponies.

The fear is they could catch the virus from their animals.

This year alone, over 60 people in the US – primarily agricultural workers – have fallen ill after exposure to infected cattle. If spillover events between wild birds and horses, donkey and other equids become more common, they could potentially become a significant vector for the virus.

The researchers took blood samples from horse herds across Mongolia and found “conclusive” evidence of spillover infections from wild birds. Among the 1,000 horses tested, at least nine had antibodies for bird flu.

The tests were conducted in Arkhangai Province, a wetland area with a large population of wild birds, and the Gobi Desert, a dry region with far less wildlife.

It’s unclear how the Mongolian horses contracted the virus, although millions of other mammals including cats, dogs, skunks, pigs, and even a polar bear have become infected by either consuming birds or coming into contact with their faeces, dropped into their environment as the birds fly above.

Last year, Mongolia experienced a deadly winter season known as ‘dzud,’ which killed millions of farm animals through cold and starvation.

It is possible that horses were forced to feed on the carcasses of dead birds, the natural carriers of H5N1, as much of Mongolia’s grazing land was frozen over. Though horses are herbivores, they will scavenge on meat as a last resort.

Wild birds infected with H5N1 have been found on every continent on Earth. The virus has been circulating in birds like waterfowl and ducks in Britain for at least three years and spillover events into mammals have occurred in animals like foxes and otters.

The virus can also spread between species, meaning that once it’s got into a herd, it could transmit between them, particularly if they are sharing the same stable, pen, food, or equipment.

It’s of particular concern in Mongolia, a country home to five million horses, almost two million more than its human population.

The animals are deeply embedded in the nation’s culture and economy and people live and work in close contact with the creatures, potentially increasing the likelihood of human transmission.

The Mongolian horse, a breed that traces back to the era of Genghis Khan, is used for many purposes like travel, herding, and sport. Horse racing in particular is deeply rooted in the country’s nomadic heritage, with school children often used as jockeys.

The creatures are also used to make airag, the national drink made from fermented horse milk and some are slaughtered for meat.

The fact horses can be infected with bird flu is a particular worry given the current situation in North America where H5N1 has spread rapidly among dairy cattle, the researchers said.

The virus could mix with others inside horses – a process known as reassortment – potentially creating a new mutant bird flu strain.

Horses can already catch equine flu, caused by H3N8, which is endemic to North America.

With the rapid spread of avian influenza among cattle in the US, the likelihood of horses and other equids coming into contact with infected cows – and the chances of horses becoming co-infected with both avian and equine influenza viruses and creating a new flu – significantly increases.

It’s the same process which triggered the 2008/09 H1N1 swine flu pandemic, where pigs were co-infected with avian and human flu and created a new, more dangerous type of virus.

It is also what was thought to have caused the 1918 Spanish flu pandemic, when pigs in Haskell County, Kansas, were infected with bird, mammal, and human influenzas at the same time.

Periods of heavy air pollution are likely in parts of Ulaanbaatar, Mongolia, during the late autumn and winter months. Air pollution-induced low visibility can lead to ground transport and flight disruptions throughout the affected area. Visibility problems are typically worse in late December-February, but periodic disruptions can occur November-March.

Ulaanbaatar's rapid growth and expansion have led to poverty and air pollution during the colder months. Ulaanbaatar's location in the narrow valley of the Bogd Mountain on the Tuul River also creates a thermal inversion layer, trapping pollution over the city. Most of the poor live in yurts or gers, traditional dwellings unconnected to the central heating system, mostly in the north of the city. During the colder months, most burn coal for heat, increasing air pollution. Ulaanbaatar's Soviet-era coal-burning power plants and vehicle emissions also contribute to winter air pollution.

The highest concentrations of air pollution usually occur during periods of extended air stagnation, when pollution from industry, residential heating, and automobiles cannot escape the region. Severe pollution levels tend to spike during winter cold spells when many people burn low-quality coal to heat their homes and businesses. Authorities have tried to reduce air pollution by curbing vehicle use, improving home insulation, and expanding the use of natural gas to reduce reliance on coal.

Reduced visibility during periods of severe air pollution may cause transport disruptions. Flight delays could occur at Chinggis Khaan International Airport (UBN), especially during overnight and early morning hours when relative humidity is high. Traffic disruptions resulting from inadequate visibility are also possible on highways and secondary roads in the region during periods of severe pollution.

Officials may implement temporary commercial restrictions. Provincial and municipal officials usually take measures to reduce heavy industry and sometimes restrict vehicle operations in response to severe air pollution. Under a red alert, Beijing authorities could restrict private vehicle use within the municipality; officials only permit vehicles with even-numbered plates to drive on even calendar days and odd-numbered plates on odd days. Severe air pollution also often causes the suspension of large-scale outdoor construction projects. Under previous orange- and red-level alerts, officials throughout the region ordered thousands of heavy industry and manufacturing facilities to cease operations. Similar policies are possible in areas throughout the region during periods of severe pollution. Such measures do not typically lead to severe supply chain disruptions, but there could be delays to some time-sensitive orders and deliveries.

Alta Resource Technologies, a Colorado-based company using advanced biochemistry in mineral separation, announced Tuesday it has raised $5.1 million in an oversubscribed seed round co-led by DCVC and Voyager Ventures, with participation from Orion Industrial Ventures, Overture, and WovenEarth Ventures.

Alta’s biochemistry platform leverages technology licensed from Lawrence Livermore National Laboratory co-developed with collaborators including researchers at Pennsylvania State University.

Sign Up for the Mining News Digest

With its first products, Alta aims to increase supplies of rare earth elements like neodymium and dysprosium – essential for electric vehicle motors, wind turbines, and defense technologies – by cost-effectively separating them from abundant low-grade sources and end-of-life products that cannot be processed using conventional methods.

Alta said its technology uses custom-designed proteins that act like microscopic robots to separate high-purity rare earth elements and other critical minerals with unprecedented selectivity and cost-effectiveness.

The Department of Defense has implemented a strategy to develop domestic supply chains to ensure continued access to the rare earth materials

The company has also secured nearly $1 million in grant funding from the federal government, including the Department of Defense’s DARPA, and the State of Colorado. Earlier funding was provided by Baruch Future Ventures and Climate Capital (now Juniper).

Rare earth metals demand is projected to increase at 10.4% compound annual growth rate (CAGR) from 2024-2033. There is currently only one producing rare earths mine in the US- MP Materials’ Mountain Pass in California.

The Department of Defense has implemented a strategy to develop domestic supply chains to ensure continued access to the rare earth materials needed to manufacture the permanent magnets used in US military weapons systems, as domestic shortages of rare earth elements and could derail the energy transition, stunt economic growth, and potentially undermine national security.

“Biology has solved the problem of ultra-selective mineral separation over billions of years, but translating that into practical applications has been elusive – until now,” Alta CEO Nathan Ratledge, PhD, said in Tuesday’s news release.

“Our technology leverages specially engineered proteins that can bind to specific metals with unprecedented selectivity, even at low concentrations in complex mixtures.

By deploying these proteins in a continuous, scalable process, we can unlock vast untapped mineral resources here at home, strengthening our supply chains and national security while setting a new standard for environmentally responsible mining.”