RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.1 RedCurl is allegedly a Russian-speaking threat actor.23 The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
- group-ib_redcurl1
- group-ib_redcurl1
- group-ib_redcurl2
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1027 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1537 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1202 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1005 | Data from Local System | — |
| T1020 | Automated Exfiltration | — |
| T1027 | Obfuscated Files or Information | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1039 | Data from Network Shared Drive | — |
| T1046 | Network Service Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.002 | GUI Input Capture | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1080 | Taint Shared Content | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1087.003 | Email Account | — |
| T1102 | Web Service | — |
| T1114.001 | Local Email Collection | — |
| T1119 | Automated Collection | — |
| T1199 | Trusted Relationship | — |
| T1202 | Indirect Command Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.011 | Rundll32 | — |
| T1537 | Transfer Data to Cloud Account | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.001 | Credentials In Files | — |
| T1552.002 | Credentials in Registry | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1573.001 | Symmetric Cryptography | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1587.001 | Malware | — |
Aliases
RedCurl
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.