Home / Threat actors / RedCurl

RedCurl G1039

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

45

Techniques

0

Malware and tools

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1587.001 Malware

Initial Access

T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1204.001 Malicious Link T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or Information T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1202 Indirect Command Execution T1218.011 Rundll32 T1564.001 Hidden Files and Directories

Credential Access

T1003.001 LSASS Memory T1056.002 GUI Input Capture T1552.001 Credentials In Files T1552.002 Credentials in Registry T1555.003 Credentials from Web Browsers

Discovery

T1046 Network Service Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1087.003 Email Account

Lateral Movement

T1080 Taint Shared Content

Collection

T1005 Data from Local System T1039 Data from Network Shared Drive T1056.002 GUI Input Capture T1114.001 Local Email Collection T1119 Automated Collection T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1102 Web Service T1573.001 Symmetric Cryptography T1573.002 Asymmetric Cryptography

Exfiltration

T1020 Automated Exfiltration T1537 Transfer Data to Cloud Account

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.