Introduction
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. Symantec Tortoiseshell 2019 CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness. Microsoft Iranian Threat Actor Trends November 2021
Activities and Tactics
Targeted Sectors: Defense, Government, Military, Finance, Energy, Healthcare, Pharmaceuticals, Telecoms, High-Tech, Media, NGOs, Civil Society, Legal, Rail, Transportation
Country of Origin: 🇮🇷 Iran
Incident Type: Espionage
Suspected Victims: United States, Israel, Middle East, Europe
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1566.003 Spearphishing via Service
- T1505.003 Web Shell
- T1204.002 Malicious File
- T1584.006 Web Services
- T1583.003 Virtual Private Server
- T1082 System Information Discovery
- T1608.004 Drive-by Target
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1005 Data from Local System
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1124 System Time Discovery
- T1598.003 Spearphishing Link
- T1189 Drive-by Compromise
- T1566.001 Spearphishing Attachment
- T1059.001 PowerShell
- T1583.001 Domains
- T1041 Exfiltration Over C2 Channel
- T1583.004 Server
ATT&CK technique IDs (denormalized)
- T1005
- T1041
- T1048.002
- T1059.001
- T1082
- T1124
- T1189
- T1204.002
- T1505.003
- T1566.001
- T1566.003
- T1583.001
- T1583.003
- T1583.004
- T1584.006
- T1585.001
- T1585.002
- T1598.003
- T1608.004
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: Iran Additional attribution information pending cataloguing.
References
[1] mitre-attack [6] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [7] Proofpoint TA456 Defense Contractor July 2021 Miller, J. et. al. (2021, July 28). I Knew You Were Trouble: TA456 Targets Defense Contractor with Alluring Social Media Persona. Retrieved March 11, 2024. [8] Microsoft Iranian Threat Actor Trends November 2021 MSTIC. (2021, November 16). Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021. Retrieved January 12, 2023. [9] PWC Yellow Liderc 2023 PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024. [10] Symantec Tortoiseshell 2019 Symantec Threat Hunter Team. (2019, September 18). Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks. Retrieved May 20, 2024.