RedCurl
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
- ATT&CK ID
- G1039
- Origin
- Russia
- Techniques
- 32
- Tools
- 0
Techniques
Resource Development
Initial Access
Execution
Scheduled Task/JobCommand and Scripting InterpreterUser Execution
Persistence
Scheduled Task/JobBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalIndirect Command ExecutionSystem Binary Proxy ExecutionHide Artifacts
Credential Access
OS Credential DumpingInput CaptureUnsecured CredentialsCredentials from Password Stores
Discovery
Network Service DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount Discovery
Lateral Movement
Collection
Data from Local SystemData from Network Shared DriveInput CaptureEmail CollectionAutomated CollectionArchive Collected Data
Command and Control
Application Layer ProtocolWeb ServiceEncrypted Channel