RedCurl

Origin🇷🇺 Rússia

Techniques (MITRE ATT&CK)41

SourceMITRE ATT&CK

Also known as:GOLD BLADERed Wolf

Vexday analysis

RedCurl é um grupo APT de origem russa, ativo desde 2018 e identificado no MITRE ATT&CK como G1039, com 41 técnicas documentadas. O grupo é notório por operações de espionagem corporativa direcionadas a diferentes países — incluindo Ucrânia, Canadá e Reino Unido — e a setores variados, como agências de viagem, seguradoras e bancos. As operações geralmente se iniciam com e-mails de spearphishing para obter acesso inicial, seguidos pela execução de comandos e scripts de descoberta e coleta de dados corporativos, encerrando-se com a exfiltração de arquivos para servidores de comando e controle (C2).

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity49

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 41

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Malware

Initial access

Trusted Relationship Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Windows Command Shell Visual Basic Python Malicious Link Malicious File

Persistence

Registry Run Keys / Startup Folder

Credential access

LSASS Memory Credentials In Files Credentials in Registry Credentials from Web Browsers

Discovery

Network Service Discovery System Information Discovery File and Directory Discovery Local Account Domain Account Email Account

Lateral movement

Taint Shared Content

Collection

Data from Local System Data from Network Shared Drive GUI Input Capture Local Email Collection Automated Collection Archive via Utility

Command and control

Web Protocols Web Service Symmetric Cryptography Asymmetric Cryptography

Exfiltration

Automated Exfiltration Transfer Data to Cloud Account

stealth

Obfuscated Files or Information Match Legitimate Resource Name or Location File Deletion Indirect Command Execution Rundll32 Hidden Files and Directories

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

RedCurl uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →