RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1]RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
41
TechniquesTop 23%
12
Tactics73rd pct
0
Tools & malwareNone recorded
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
RedCurl has used malware with string encryption.10RedCurl has also encrypted data and has encoded PowerShell commands using Base64.1112RedCurl has used PyArmor to obfuscate code execution of LaZagne. 11 Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used echo, instead of file names themselves, to execute files.13
RedCurl mimicked legitimate file names and scheduled tasks, e.g. MicrosoftCurrentupdatesCheck and
MdMMaintenenceTask to mask malicious files and scheduled tasks.1516
RedCurl has collected data about network drives.1718
Collection3 detection rules
Standing G1039
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques41Top 23%
77th percentile · 77% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics1273rd pct
73rd percentile · 73% of 176 ATT&CK groups have this many tactics spanned or fewer.
Tools & malware0Bottom 9%
9th percentile · 91% of 176 ATT&CK groups have more tools and malware.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique22med59th pct
59th percentile · 59% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Tests / technique4med66th pct
66th percentile · 66% of 176 ATT&CK groups have this many atomic tests per technique or fewer.
Data comps / technique4med65% tie · 12 values
65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique2med43% tie · 11 values
43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 41 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
The following analytic detects suspicious registry modifications that implement auto admin logon by adding DefaultUserName and DefaultPassword values. (...)
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
The following analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. (...)
The following analytic detects a series of AWS API calls related to EC2 snapshots within a short time window, indicating potential exfiltration via EC2 Snapshot modifications. (...)