defection.io

group

Scarlet Mimic G0029

Created: 31 May 2017
Last modified: 31 July 2026
Alias: Scarlet Mimic

Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same. [1]

TechniqueBottom 5%

TacticBottom 6%

Tools & malware55th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

group

Scarlet Mimic G0029

Created: 31 May 2017
Last modified: 31 July 2026
Alias: Scarlet Mimic

TechniqueBottom 5%

TacticBottom 6%

Tools & malware55th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Scarlet Mimic MITRE reference G0029

Right-to-Left Override T1036.002 ↗

Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.2

Stealth5 detection rules

Standing G0029

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 176 ATT&CK groups have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 176 ATT&CK groups have more tactics spanned.

Tools & malware455th pct

55th percentile · 55% of 176 ATT&CK groups have this many tools and malware or fewer.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique5medBottom 13%

13th percentile · 87% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique2med

Scarlet Mimic detections G0029

5 distinct rules cover the 1 technique recorded for this group. 3 Sigma · 2 Splunk.

1 covered by at least one rule5 distinct rules in total

Showing 1-5 of 5 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies the use of the right-to-left override (RTLO) character in file nam (...)	Generic	stable	file_event	windows	Sysmon	Stealth Masquerading Right-to-Left Override	-	medium	Steven Dick	2023-05-01	2026-05-13	468b7e11-d362-43b8-b6ec-7a2d3b246678
Splunk	The following analytic identifies the abuse of the right-to-left override (RTLO) character (U+202E) in process names. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Masquerading Right-to-Left Override	-	medium	Steven Dick	2023-05-01	2026-05-13	22ac27b4-7189-4a4f-9375-b9017c9620d7
	Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Right-to-Left Override Stealth System Binary Proxy Execution MMC Execution User Execution Malicious File	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9cfe4b27-1e56-48b4-b7a8-d46851c91a44
	Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Right-to-Left Override	-	high	Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux	2023-02-15	2026-03-20	ad691d92-15f2-4181-9aa4-723c74f9ddc3
	Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Right-to-Left Override	-	high	Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2024-11-17	2026-03-20	979baf41-ca44-4540-9d0c-4fcef3b5a3a4