Introduction
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. group-ib_redcurl1 RedCurl is allegedly a Russian-speaking threat actor. group-ib_redcurl1 group-ib_redcurl2 The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1027 Obfuscated Files or Information
- T1564.001 Hidden Files and Directories
- T1102 Web Service
- T1114.001 Local Email Collection
- T1039 Data from Network Shared Drive
- T1080 Taint Shared Content
- T1204.002 Malicious File
- T1005 Data from Local System
- T1119 Automated Collection
- T1083 File and Directory Discovery
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1036.005 Match Legitimate Resource Name or Location
- T1566.001 Spearphishing Attachment
- T1059.005 Visual Basic
- T1560.001 Archive via Utility
- T1573.001 Symmetric Cryptography
- T1071.001 Web Protocols
- T1087.003 Email Account
- T1587.001 Malware
- T1087.001 Local Account
- T1056.002 GUI Input Capture
- T1082 System Information Discovery
- T1204.001 Malicious Link
- T1573.002 Asymmetric Cryptography
- T1053.005 Scheduled Task
- T1020 Automated Exfiltration
- T1199 Trusted Relationship
- T1537 Transfer Data to Cloud Account
- T1202 Indirect Command Execution
- T1552.001 Credentials In Files
- T1218.011 Rundll32
- T1087.002 Domain Account
- T1566.002 Spearphishing Link
- T1552.002 Credentials in Registry
- T1070.004 File Deletion
- T1547.001 Registry Run Keys / Startup Folder
- T1555.003 Credentials from Web Browsers
- T1059.006 Python
- T1003.001 LSASS Memory
- T1046 Network Service Discovery
ATT&CK technique IDs (denormalized)
- T1003.001
- T1005
- T1020
- T1027
- T1036.005
- T1039
- T1046
- T1053.005
- T1056.002
- T1059.001
- T1059.003
- T1059.005
- T1059.006
- T1070.004
- T1071.001
- T1080
- T1082
- T1083
- T1087.001
- T1087.002
- T1087.003
- T1102
- T1114.001
- T1119
- T1199
- T1202
- T1204.001
- T1204.002
- T1218.011
- T1537
- T1547.001
- T1552.001
- T1552.002
- T1555.003
- T1560.001
- T1564.001
- T1566.001
- T1566.002
- T1573.001
- T1573.002
- T1587.001
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
Information pending cataloguing.
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [2] group-ib_redcurl1 Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024. [3] group-ib_redcurl2 Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.