group
RedCurl G1039
- Created
- 23 September 2024
- Last modified
- 31 July 2026
- Alias
- RedCurl
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1] RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G1039
RedCurl has collected data from the local disk of compromised hosts.67
RedCurl has used malware with string encryption.10 RedCurl has also encrypted data and has encoded PowerShell commands using Base64.1112 RedCurl has used PyArmor to obfuscate code execution of LaZagne. 11 Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used echo, instead of file names themselves, to execute files.13
RedCurl mimicked legitimate file names and scheduled tasks, e.g. MicrosoftCurrentupdatesCheck and
MdMMaintenenceTask to mask malicious files and scheduled tasks.1516
Standing G1039
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
77th percentile · 77% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
73rd percentile · 73% of 176 ATT&CK groups have this many tactics spanned or fewer.
9th percentile · 91% of 176 ATT&CK groups have more tools and malware.
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
60th percentile · 60% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Detection coverage G1039
1262 distinct rules cover the 41 techniques recorded for this group. The 1493 technique-to-rule mappings resolve to 1262 distinct rules, because one rule can cover several techniques. 895 Sigma · 367 Splunk.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org