MITRE ATT&CKgroup
G1039 RedCurl
- Domain
- enterprise
- Version
- 1.0
- Created
- 2024-09-23
Description
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
Related
Uses · MITRE ATT&CK (41)
- T1587.001 Malware sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1059.006 Python sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1087.003 Email Account sub-technique
- T1560.001 Archive via Utility sub-technique
- T1114.001 Local Email Collection sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1003.001 LSASS Memory sub-technique
- T1056.002 GUI Input Capture sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1552.001 Credentials In Files sub-technique
- T1552.002 Credentials in Registry sub-technique
- T1070.004 File Deletion sub-technique
- T1218.011 Rundll32 sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1537 Transfer Data to Cloud Account technique
- T1199 Trusted Relationship technique
References
- https://www.group-ib.com/resources/research-hub/red-curl/ group-ib_redcurl1
- https://www.group-ib.com/resources/research-hub/red-curl-2/ group-ib_redcurl2