Início / Grupos de ameaça / RedCurl

RedCurl G1039

🔔 Criar alerta

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

45

Técnicas

0

Malwares e ferramentas

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Desenvolvimento de recursos

T1587.001 Malware

Acesso inicial

T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1204.001 Malicious Link T1204.002 Malicious File

Persistência

T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027 Obfuscated Files or Information T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1202 Indirect Command Execution T1218.011 Rundll32 T1564.001 Hidden Files and Directories

Acesso a credenciais

T1003.001 LSASS Memory T1056.002 GUI Input Capture T1552.001 Credentials In Files T1552.002 Credentials in Registry T1555.003 Credentials from Web Browsers

Descoberta

T1046 Network Service Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1087.003 Email Account

Movimento lateral

T1080 Taint Shared Content

Coleta

T1005 Data from Local System T1039 Data from Network Shared Drive T1056.002 GUI Input Capture T1114.001 Local Email Collection T1119 Automated Collection T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1102 Web Service T1573.001 Symmetric Cryptography T1573.002 Asymmetric Cryptography

Exfiltração

T1020 Automated Exfiltration T1537 Transfer Data to Cloud Account

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.