MITRE ATT&CKgroup

G1012 CURIUM

Published 2023-01-13 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc
Version
3.0
Created
2023-01-13

Description

CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.

Related

Uses · MITRE ATT&CK (20)

  • S1152 IMAPLoader software (malware)
  • T1608.004 Drive-by Target sub-technique
  • T1598.003 Spearphishing Link sub-technique
  • T1583.003 Virtual Private Server sub-technique
  • T1583.004 Server sub-technique
  • T1584.006 Web Services sub-technique
  • T1585.001 Social Media Accounts sub-technique
  • T1585.002 Email Accounts sub-technique
  • T1583.001 Domains sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.003 Spearphishing via Service sub-technique
  • T1505.003 Web Shell sub-technique
  • T1189 Drive-by Compromise technique
  • T1005 Data from Local System technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1082 System Information Discovery technique
  • T1124 System Time Discovery technique

References