LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1039: RedCurl

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1] RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.

EnterpriseG1039GroupObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

RedCurl matters because ATT&CK describes it as a corporate espionage group that starts with spearphishing, performs discovery and collection to locate business data, and exfiltrates files to command-and-control servers. For leaders, the practical issue is not just malware detection; it is whether the organization can prove it can detect data reconnaissance, credential access, shared-drive collection, email/local file harvesting, and outbound web-based exfiltration before sensitive corporate information leaves the environment.

Executive priority

Prioritize RedCurl as a test case for espionage-focused resilience: phishing-to-data-theft readiness, credential protection, shared-drive governance, email/data handling, and incident response evidence quality. Security leaders should ask whether SOC telemetry covers scripted discovery, LSASS access, scheduled task persistence, PowerShell/cmd/VB/Python execution, and abnormal outbound web traffic. Risk owners should also validate whether sensitive data on endpoints, network shares, and local email stores is classified, access-controlled, and monitored well enough to support audit and investigation decisions.

Technical view

ATT&CK provides no official detection text for RedCurl, so defenders should derive validation from the mapped techniques. Emphasis should be on Windows-heavy behaviors in the relationships, including LSASS memory access, scheduled tasks, PowerShell, Windows command shell, Visual Basic, local email collection, account discovery, file/directory discovery, and web-protocol C2. Also validate coverage for cross-platform or non-Windows relationship context where relevant, including Python execution, automated collection/exfiltration, network share access, web services for C2, obfuscated files, masqueraded resource names/locations, and file deletion. Build detections around behavior chains rather than single commands: phishing-led initial access followed by discovery, credential access, collection from local systems or shared drives, and outbound transfer to C2 infrastructure.

Likely telemetry

  • Endpoint process creation and command-line logging for PowerShell, cmd, VB-related execution, Python, discovery commands, and file operations
  • Windows security and EDR telemetry for LSASS access, suspicious credential material access, and privilege context
  • Scheduled task creation, modification, and execution records
  • File system telemetry for bulk discovery, staging, copying, deletion, obfuscated/archive-like files, and access to local email stores such as Outlook cache/storage files
  • Network share access logs and file server audit logs for unusual enumeration or collection from shared drives

Detection direction

  • Validate whether detections correlate multiple mapped behaviors: spearphishing entry, scripted execution, discovery, collection, credential access, persistence, and exfiltration.
  • Tune PowerShell, cmd, VB, and Python detections to reduce noise from administration while highlighting unusual parent processes, rare users, unexpected hosts, encoded or obfuscated content, and activity outside normal maintenance windows.
  • Monitor LSASS access carefully, separating legitimate security tooling from unusual process access or dump-like behavior.
  • Baseline scheduled task activity and alert on new or modified tasks created by unexpected users, scripts, or locations.
  • Look for abnormal enumeration of files, directories, local accounts, domain accounts, email accounts, services, and network shares, especially when followed by copying, archiving, deletion, or outbound web traffic.

Mitigation priorities

  • Harden phishing resistance and user reporting processes, since the official description says operations typically begin with spearphishing emails.
  • Reduce credential theft exposure by limiting administrative privileges, protecting LSASS, and monitoring privileged access paths.
  • Apply least privilege and access review to network shares, local sensitive data stores, and email data; reduce broad access to corporate documents where possible.
  • Constrain and monitor scripting interpreters and scheduled task creation according to business need.
  • Improve data classification, retention, and logging for files likely to be valuable in corporate espionage scenarios.
Additional notes and limits

The supplied ATT&CK description characterizes RedCurl as active since 2018, associated with corporate espionage against multiple locations and industries, and allegedly Russian-speaking. The relationship set is useful for building a defensive scenario: credential access, execution through scripting, discovery, collection from endpoints/shares/email, C2 over web protocols or web services, and automated exfiltration. Treat this as a behavior-driven coverage review rather than an attribution-driven hunting package.

Platforms and tactics are not specified on the group object itself, and ATT&CK provides no official detection text for this object. Platform references in this take come from related techniques, not from a group-level platform declaration. The supplied data does not support claims about current activity, confirmed attribution, customer exposure, specific infrastructure, malware, indicators, or guaranteed detection coverage. Local telemetry, asset scope, and business data locations are required to determine actual risk and control effectiveness.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

RedCurl

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1] RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

41 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or Information

RedCurl has used malware with string encryption.[3] RedCurl has also encrypted data and has encoded PowerShell commands using Base64.[1][2] RedCurl has used `PyArmor` to obfuscate code execution of LaZagne. [1] Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.[4]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.[1][2]

EnterpriseT1102Web Service

RedCurl has used web services to download malicious files.[1][2]

EnterpriseT1114.001Local Email CollectionSub-technique

RedCurl has collected emails to use in future phishing campaigns.[1]

EnterpriseT1039Data from Network Shared Drive

RedCurl has collected data about network drives.[1][2]

EnterpriseT1080Taint Shared Content

RedCurl has placed modified LNK files on network drives for lateral movement.[1][2]

EnterpriseT1204.002Malicious FileSub-technique

RedCurl has used malicious files to infect the victim machines.[1][2][4]

EnterpriseT1005Data from Local System

RedCurl has collected data from the local disk of compromised hosts.[1][2]

EnterpriseT1119Automated Collection

RedCurl has used batch scripts to collect data.[1][2]

EnterpriseT1083File and Directory Discovery

RedCurl has searched for and collected files on local and network drives.[3][1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

RedCurl has used the Windows Command Prompt to execute commands.[1][2][4]

EnterpriseT1059.001PowerShellSub-technique

RedCurl has used PowerShell to execute commands and to download malware.[1][2][4]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

RedCurl mimicked legitimate file names and scheduled tasks, e.g. ` MicrosoftCurrentupdatesCheck` and `MdMMaintenenceTask` to mask malicious files and scheduled tasks.[1][2]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

RedCurl has used phishing emails with malicious files to gain initial access.[1][4]

EnterpriseT1059.005Visual BasicSub-technique

RedCurl has used VBScript to run malicious files.[1][2]

EnterpriseT1560.001Archive via UtilitySub-technique

RedCurl has downloaded 7-Zip to decompress password protected archives.[4]

EnterpriseT1573.001Symmetric CryptographySub-technique

RedCurl has used AES-128 CBC to encrypt C2 communications.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.[1][2]

EnterpriseT1087.003Email AccountSub-technique

RedCurl has collected information about email accounts.[1][2]

EnterpriseT1587.001MalwareSub-technique

RedCurl has created its own tools to use during operations.[3]

EnterpriseT1087.001Local AccountSub-technique

RedCurl has collected information about local accounts.[1][2]

EnterpriseT1056.002GUI Input CaptureSub-technique

RedCurl prompts the user for credentials through a Microsoft Outlook pop-up.[1][2]

EnterpriseT1082System Information Discovery

RedCurl has collected information about the target system, such as system information and list of network connections.[1][2]

EnterpriseT1204.001Malicious LinkSub-technique

RedCurl has used malicious links to infect the victim machines.[1][2]

EnterpriseT1573.002Asymmetric CryptographySub-technique

RedCurl has used HTTPS for C2 communication.[1][2]

EnterpriseT1053.005Scheduled TaskSub-technique

RedCurl has created scheduled tasks for persistence.[1][2][4]

EnterpriseT1020Automated Exfiltration

RedCurl has used batch scripts to exfiltrate data.[1][2]

EnterpriseT1199Trusted Relationship

RedCurl has gained access to a contractor to pivot to the victim’s infrastructure.[3]

EnterpriseT1537Transfer Data to Cloud Account

RedCurl has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.[1][2]

EnterpriseT1202Indirect Command Execution

RedCurl has used pcalua.exe to obfuscate binary execution and remote connections.[4]

EnterpriseT1552.001Credentials In FilesSub-technique

RedCurl used LaZagne to obtain passwords in files.[1][2]

EnterpriseT1218.011Rundll32Sub-technique

RedCurl has used rundll32.exe to execute malicious files.[1][2][4]

EnterpriseT1087.002Domain AccountSub-technique

RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .[1][2]

EnterpriseT1566.002Spearphishing LinkSub-technique

RedCurl has used phishing emails with malicious links to gain initial access.[1][2]

EnterpriseT1552.002Credentials in RegistrySub-technique

RedCurl used LaZagne to obtain passwords in the Registry.[1][2]

EnterpriseT1070.004File DeletionSub-technique

RedCurl has deleted files after execution.[1][2][4]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

RedCurl has established persistence by creating entries in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.[1][2]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

RedCurl used LaZagne to obtain passwords from web browsers.[1][2]

EnterpriseT1059.006PythonSub-technique

RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.[4]

EnterpriseT1003.001LSASS MemorySub-technique

RedCurl used LaZagne to obtain passwords from memory.[1][2]

EnterpriseT1046Network Service Discovery

RedCurl has used netstat to check if port 4119 is open.[4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1114.001: Local Email CollectionEnterpriseuses · TechniqueT1039: Data from Network Shared DriveEnterpriseuses · TechniqueT1080: Taint Shared ContentEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1087.003: Email AccountEnterpriseuses · TechniqueT1587.001: MalwareEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1056.002: GUI Input CaptureEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
320d14f2b03d0922...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle320d14f2b03d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  2. [2]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  3. [3]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  4. [4]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  5. [5]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  6. [6]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  7. [7]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  8. [8]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  9. [9]
    mitre-attackG1039
    Open source URL
  10. [10]
    mitre-attackG1039
    Open source URL
  11. [11]
    mitre-attackG1039
    Open source URL
  12. [12]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  13. [13]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  14. [14]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  15. [15]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  16. [16]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  17. [17]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  18. [18]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  19. [19]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  20. [20]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  21. [21]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  22. [22]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  23. [23]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  24. [24]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  25. [25]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  26. [26]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  27. [27]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  28. [28]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  29. [29]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  30. [30]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  31. [31]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  32. [32]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  33. [33]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  34. [34]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  35. [35]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  36. [36]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  37. [37]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  38. [38]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  39. [39]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  40. [40]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  41. [41]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  42. [42]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  43. [43]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  44. [44]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  45. [45]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  46. [46]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  47. [47]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  48. [48]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  49. [49]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  50. [50]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  51. [51]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  52. [52]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  53. [53]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  54. [54]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  55. [55]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  56. [56]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  57. [57]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  58. [58]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  59. [59]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  60. [60]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  61. [61]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  62. [62]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  63. [63]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  64. [64]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  65. [65]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  66. [66]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  67. [67]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  68. [68]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  69. [69]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  70. [70]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  71. [71]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  72. [72]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  73. [73]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  74. [74]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  75. [75]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  76. [76]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  77. [77]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  78. [78]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  79. [79]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  80. [80]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  81. [81]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  82. [82]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  83. [83]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  84. [84]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  85. [85]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  86. [86]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  87. [87]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  88. [88]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  89. [89]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  90. [90]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  91. [91]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  92. [92]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  93. [93]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  94. [94]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  95. [95]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  96. [96]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  97. [97]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  98. [98]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  99. [99]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  100. [100]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  101. [101]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  102. [102]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  103. [103]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  104. [104]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  105. [105]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  106. [106]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  107. [107]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  108. [108]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  109. [109]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  110. [110]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  111. [111]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  112. [112]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  113. [113]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  114. [114]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  115. [115]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  116. [116]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  117. [117]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  118. [118]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  119. [119]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  120. [120]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  121. [121]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  122. [122]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  123. [123]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  124. [124]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  125. [125]
    therecord_redcurl

    Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.

    Open source URL
  126. [126]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  127. [127]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  128. [128]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  129. [129]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  130. [130]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  131. [131]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  132. [132]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  133. [133]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  134. [134]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  135. [135]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  136. [136]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  137. [137]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  138. [138]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  139. [139]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  140. [140]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  141. [141]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  142. [142]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  143. [143]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  144. [144]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  145. [145]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  146. [146]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  147. [147]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  148. [148]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  149. [149]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  150. [150]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  151. [151]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  152. [152]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  153. [153]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  154. [154]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  155. [155]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  156. [156]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  157. [157]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  158. [158]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  159. [159]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  160. [160]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  161. [161]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  162. [162]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  163. [163]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  164. [164]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  165. [165]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  166. [166]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
  167. [167]
    group-ib_redcurl1

    Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.

    Open source URL
  168. [168]
    group-ib_redcurl2

    Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.

    Open source URL
  169. [169]
    trendmicro_redcurl

    Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use