group
CURIUM G1012
- Created
- 13 January 2023
- Last modified
- 31 July 2026
- Aliases
- CURIUM · Crimson Sandstorm · TA456 · Tortoise Shell · Yellow Liderc
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.[1] CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.[2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G1012
CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.4
CURIUM has used SMTPS to exfiltrate collected data from victims.5
CURIUM has leveraged PowerShell scripts for initial process execution and data gathering in victim environments.6
CURIUM deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.7
CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.8
Standing G1012
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
52nd percentile · 52% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
48th percentile · 52% of 176 ATT&CK groups have more tactics spanned.
23rd percentile · 77% of 176 ATT&CK groups have more tools and malware.
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
5th percentile · 95% of 176 ATT&CK groups have more detection rules per technique.
Detection coverage G1012
557 distinct rules cover the 19 techniques recorded for this group. The 576 technique-to-rule mappings resolve to 557 distinct rules, because one rule can cover several techniques. 382 Sigma · 175 Splunk.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org