china

Will RedNovember be publicly reported to exploit at least one zero-day vulnerability in 2026?

RedNovember likely stays fast-follow on edge devices using N-days and public PoCs, not 0-days. China-nexus peers show willingness to burn edge 0-days, so a pivot is plausible but not base case...

Wes

Wes

— 4 min read
Will RedNovember be publicly reported to exploit at least one zero-day vulnerability in 2026?
RedNovember at the midnight claw machine—lots of PoC quarters, one very expensive prize.

Early Look: AlphaHunt Forecasting

We’re giving our subscribers a look at something new: AlphaHunt’s early-stage, next-generation forecasting technology.

Most intel tools tell you what already happened. Forecasting asks a harder, more valuable question: what’s likely to happen next, and how should we prepare? We’re experimenting with structured probability models that connect threat intelligence to incident response. Think of it as a way to quantify uncertainty before the attacker makes their next move.

Why it matters for security teams

  • Move left of boom – Instead of reacting to the breach or extortion email, teams get an evidence-based probability of escalation. That helps decide whether to harden defenses now or stage response playbooks in advance.

  • Translate noise into action – Forecasts take vague “chatter” or scattered reporting and turn it into calibrated odds with defined resolution criteria. That means you can brief leadership with confidence, not hand-waving.

  • Stress test readiness – Pairing forecast scenarios with your incident response plan highlights blind spots. If one scenario says “55% odds on a new non-Ivanti edge 0-day by Dec 31...” the next question is: are we ready for that exact play?

This is early stage work.

You’ll see a forecast card in this issue that show how I'm approaching the problem: clear questions, base rates, scenarios, and signals to watch.

I'm asking you for feedback. Is this useful in your daily workflow? What kinds of forecasts would help you brief your SOC, IR team, or leadership? Should we track adversary infrastructure launches, vulnerability weaponization, law-enforcement takedowns?

AlphaHunt’s mission is to make threat intelligence more actionable, measurable, and forward-looking. Forecasting is one piece of that puzzle. If it resonates, expect to see it become a regular feature in our platform.

Let me know what you think— I'm listening.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Executive Overview

Baseline: RedNovember likely stays fast-follow on edge devices using N-days and public PoCs, not 0-days. China-nexus peers show willingness to burn edge 0-days, so a pivot is plausible but not base case. Watch for pre-advisory exploitation tied to RedNovember, a novel C2/malware family across multiple victims, and multi-vendor confirmation of a pre-patch edge exploit.

CTA Image

Ready to level up your intelligence game?

Sign Up!

AlphaHunt Forecast Card

Question

Will RedNovember be publicly reported to exploit at least one zero-day vulnerability in 2026?

Resolution Criteria

Yes if a report published in 2026 by a reputable vendor or government (Google Threat Intelligence/Mandiant, Microsoft Threat Intelligence, Palo Alto Networks Unit 42, Cisco Talos, Broadcom Symantec, Volexity, CISA/NSA/UK NCSC) attributes exploitation by RedNovember (or rebrand/alias with evidenced lineage via infrastructure, malware code similarity, or explicit cross-vendor mapping) of a vulnerability before both public patch availability and public disclosure (first vendor acknowledgement/advisory or CVE). No otherwise.

  • Horizon: 2026-12-31 23:59 America/New_York
  • Probability (Now): 30% | Log-odds: -0.85
  • Confidence in Inputs: Medium
  • Base Rate: 25% from actor-level reference class: among 4 China-nexus edge-focused clusters observable in 2024–2025 (UNC5221, Volt Typhoon, BlackTech, RedNovember), 1/4 used ≥1 0-day (UNC5221 on Ivanti ICS)

Top Drivers

  • RedNovember’s PoC-first N-day/edge tradecraft (Pantegana/SparkRAT) persists in 2024–2025 reporting.
  • China-nexus espionage clusters have recently used edge-device 0-days (Ivanti ICS 2025; PAN-OS 2024; Cisco ASA/FTD campaigns).
  • Defender hardening on edge increases incentive to spend 0-days for stealthy initial access.
  • Potential rebrand/splintering could diffuse attribution and reduce public confirmations.

Scenarios (sum=100%)

  • Continues PoC/N-day edge exploitation; no confirmed 0-day: 55%
  • Uses ≥1 0-day for edge initial access: 30%
  • Rebrands/splinters; visibility drops; no confirmed 0-day: 10%
  • Shifts to firmware/supply-chain tradecraft (low-visibility 0-day use not confirmed): 5%

Signals (▲ up / ▼ down)

  • ▲ Pre-advisory exploitation ≥7 days before vendor disclosure tied to RedNovember; sources: vendor PSIRT timelines (Cisco/Unit 42/Ivanti), IR blogs (Volexity, Mandiant), CISA KEV.
  • ▲ Novel RedNovember malware/C2 family seen in ≥3 victim orgs and corroborated by ≥2 sources (e.g., VirusTotal Collection + EDR telemetry or passive DNS); sources: VirusTotal Collections, passive DNS, XDR/EDR vendor notes.
  • ▲ Edge 0-day chain without public PoC observed by ≥2 independent vendors; sources: Unit 42, Mandiant, Microsoft TI.
  • ▼ Exploitation spikes ≤48 hours after PoC release dominate RedNovember activity; sources: watchTowr/GitHub PoC timestamps vs incident timelines.
  • ▼ Continued reliance on Pantegana/SparkRAT with no new implants through Q2–Q3 2026; sources: vendor threat blogs, VT sample clustering.
  • ▼ Attribution diffusion with no lineage evidence across rebrands in 2026; sources: cross-vendor mapping.
  • Metacognitive Note: Held near 30% given persistent PoC-first pattern despite PRC edge 0-day precedent; no extremization.
  • Next Review: 2025-11-01, then monthly; event-triggered within 72 hours of any relevant advisory/report. Attribution adjudication: require ≥2 of (infrastructure overlaps, ≥80% code similarity, explicit cross-vendor linkage) for rebrands.

Appendix

References

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

(c) 2025 CSIRT Gadgets, LLC

Read more