CVE Intelligence
Home / Threat actors / CURIUM

CURIUM G1012

🔔 Create alert

Also known as: Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
19
Techniques
1
Malware and tools

CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1598.003 Spearphishing Link
Resource Development
T1583.001 DomainsT1583.003 Virtual Private ServerT1583.004 ServerT1584.006 Web ServicesT1585.001 Social Media AccountsT1585.002 Email AccountsT1608.004 Drive-by Target
Initial Access
T1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service
Execution
T1059.001 PowerShellT1204.002 Malicious File
Persistence
T1505.003 Web Shell
Discovery
T1082 System Information DiscoveryT1124 System Time Discovery
Collection
T1005 Data from Local System
Exfiltration
T1041 Exfiltration Over C2 ChannelT1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.