Trusted Design

CURIUM

アクターID: G1012

· MITRE Pageへのリンク

脅威アクターの詳細

CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.(Citation: Symantec Tortoiseshell 2019) CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.(Citation: Microsoft Iranian Threat Actor Trends November 2021)

脅威アクターの別名・別称

CURIUM
Crimson Sandstorm
TA456
Tortoise Shell
Yellow Liderc

利用した攻撃手法

• T1087.002 - Domain Account
• T1566.002 - Spearphishing Link
• T1598.003 - Spearphishing Link
• T1115 - Clipboard Data
• T1120 - Peripheral Device Discovery
• T1584.003 - Virtual Private Server
• T1098.007 - Additional Local or Domain Groups
• T1555.003 - Credentials from Web Browsers
• T1557.003 - DHCP Spoofing
• T1183 - Image File Execution Options Injection
• T1175 - Component Object Model and Distributed COM
• T1205.001 - Port Knocking
• T1087.004 - Cloud Account
• T1497.002 - User Activity Based Checks
• T1218.001 - Compiled HTML File
• T1565 - Data Manipulation
• T1059.012 - Hypervisor CLI
• T1578.001 - Create Snapshot
• T1547.008 - LSASS Driver

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1218.001)
• CVE-2015-1770 (T1497.002)
• CVE-2015-2545 (T1598.003)
• CVE-2017-0199 (T1497.002)
• CVE-2012-0158 (T1115)
• CVE-2013-3906 (T1218.001)
• CVE-2014-6352 (T1218.001)
• CVE-2015-0016 (T1598.003)
• CVE-2010-3333 (T1566.002)
• CVE-2010-0188 (T1566.002)
• CVE-2010-2884 (T1218.001)
• CVE-2013-0640 (T1566.002)
• CVE-2011-0611 (T1547.008)
• CVE-2015-5119 (T1218.001)
• CVE-2015-5122 (T1218.001)
• CVE-2015-1427 (T1547.008)
• CVE-2012-1856 (T1566.002)
• CVE-2015-2546 (T1547.008)
• CVE-2014-6332 (T1555.003)
• CVE-2015-3785 (T1566.002)
• CVE-2015-5897 (T1087.004)
• CVE-2015-7645 (T1218.001)
• CVE-2017-12149 (T1566.002)
• CVE-2015-3043 (T1218.001)
• CVE-2015-3456 (T1555.003)
• CVE-2015-3090 (T1547.008)
• CVE-2010-1553 (T1547.008)
• CVE-2015-3113 (T1218.001)
• CVE-2015-2590 (T1566.002)
• CVE-2015-2424 (T1566.002)
• CVE-2015-5477 (T1566.002)
• CVE-2015-4495 (T1059.012)
• CVE-2014-1761 (T1598.003)
• CVE-2015-2502 (T1059.012)
• CVE-2014-6271 (T1547.008)
• CVE-2013-2094 (T1218.001)
• CVE-2014-4113 (T1218.001)
• CVE-2015-8562 (T1566.002)
• CVE-2015-7808 (T1566.002)
• CVE-2012-1889 (T1218.001)
• CVE-2016-1990 (T1566.002)
• CVE-2016-1991 (T1566.002)
• CVE-2016-1010 (T1547.008)
• CVE-2016-1019 (T1547.008)
• CVE-2016-0984 (T1218.001)
• CVE-2016-1001 (T1547.008)
• CVE-2016-0998 (T1547.008)
• CVE-2015-1641 (T1566.002)
• CVE-2015-1701 (T1566.002)
• CVE-2015-0313 (T1218.001)
• CVE-2015-0359 (T1218.001)
• CVE-2014-0329 (T1175)
• CVE-2015-5130 (T1547.008)
• CVE-2015-5134 (T1547.008)
• CVE-2015-5539 (T1547.008)
• CVE-2015-5557 (T1547.008)
• CVE-2015-5563 (T1547.008)
• CVE-2015-5559 (T1547.008)
• CVE-2015-5540 (T1547.008)
• CVE-2015-5561 (T1547.008)
• CVE-2015-5551 (T1547.008)
• CVE-2015-5564 (T1547.008)
• CVE-2015-5565 (T1547.008)
• CVE-2015-5550 (T1547.008)
• CVE-2015-5566 (T1547.008)
• CVE-2015-5127 (T1547.008)
• CVE-2015-5556 (T1547.008)
• CVE-2015-5749 (T1566.002)
• CVE-2015-3628 (T1566.002)
• CVE-2015-6034 (T1566.002)
• CVE-2015-2852 (T1115)
• CVE-2015-2854 (T1566.002)
• CVE-2015-2853 (T1598.003)
• CVE-2015-7755 (T1566.002)
• CVE-2012-4969 (T1497.002)
• CVE-2016-1898 (T1183)
• CVE-2016-1897 (T1183)
• CVE-2016-1287 (T1547.008)
• CVE-2015-7261 (T1566.002)
• CVE-2015-6036 (T1566.002)
• CVE-2015-6022 (T1566.002)
• CVE-2015-7262 (T1566.002)
• CVE-2015-8286 (T1566.002)
• CVE-2015-8287 (T1566.002)
• CVE-2016-1562 (T1566.002)
• CVE-2016-2342 (T1555.003)
• CVE-2016-2343 (T1566.002)
• CVE-2017-0263 (T1547.008)
• CVE-2017-0261 (T1566.002)
• CVE-2017-0262 (T1566.002)
• CVE-2016-6532 (T1566.002)
• CVE-2016-9494 (T1218.001)
• CVE-2016-9496 (T1183)
• CVE-2016-9495 (T1183)
• CVE-2017-3212 (T1566.002)
• CVE-2025-55182 (T1087.004)
• CVE-2025-61882 (T1566.002)
• CVE-2015-0311 (T1218.001)
• CVE-2015-0932 (T1566.002)
• CVE-2012-0056 (T1566.002)
• CVE-2010-3081 (T1175)
• CVE-2012-3213 (T1566.002)
• CVE-2012-4792 (T1059.012)
• CVE-2014-0322 (T1059.012)
• CVE-2012-1258 (T1566.002)
• CVE-2015-0336 (T1547.008)
• CVE-2011-3544 (T1566.002)
• CVE-2014-3153 (T1566.002)
• CVE-2014-7911 (T1566.002)
• CVE-2014-4322 (T1555.003)
• CVE-2015-3636 (T1175)
• CVE-2013-6282 (T1218.001)
• CVE-2015-3105 (T1218.001)
• CVE-2014-0497 (T1218.001)
• CVE-2014-8361 (T1566.002)
• CVE-2017-16929 (T1598.003)
• CVE-2017-17215 (T1566.002)
• CVE-2013-0074 (T1566.002)
• CVE-2012-0507 (T1547.008)
• CVE-2013-2465 (T1547.008)
• CVE-2014-8439 (T1218.001)
• CVE-2013-2551 (T1059.012)
• CVE-2014-0569 (T1218.001)
• CVE-2014-0515 (T1218.001)
• CVE-2015-0310 (T1218.001)
• CVE-2012-4681 (T1578.001)
• CVE-2014-1776 (T1218.001)
• CVE-2014-0556 (T1547.008)
• CVE-2012-1876 (T1183)
• CVE-2015-5560 (T1218.001)
• CVE-2015-0057 (T1566.002)
• CVE-2012-2539 (T1598.003)
• CVE-2015-0071 (T1059.012)
• CVE-2014-9163 (T1218.001)
• CVE-2012-1723 (T1566.002)
• CVE-2015-1761 (T1175)
• CVE-2014-8440 (T1218.001)
• CVE-2013-3660 (T1598.003)
• CVE-2010-0806 (T1566.002)
• CVE-2010-1297 (T1218.001)
• CVE-2013-7331 (T1218.001)
• CVE-2015-2360 (T1566.002)
• CVE-2014-4148 (T1218.001)
• CVE-2011-3402 (T1566.002)
• CVE-2014-6324 (T1566.002)
• CVE-2010-2883 (T1566.002)
• CVE-2013-0634 (T1547.008)
• CVE-2014-7247 (T1547.008)
• CVE-2012-5054 (T1218.001)
• CVE-2013-2678 (T1183)
• CVE-2010-0738 (T1547.008)
• CVE-2015-2426 (T1566.002)
• CVE-2008-1436 (T1557.003)
• CVE-2010-0232 (T1566.002)
• CVE-2010-4398 (T1566.002)
• CVE-2013-0641 (T1566.002)
• CVE-2014-3393 (T1547.008)
• CVE-2012-6422 (T1547.008)
• CVE-2013-2595 (T1555.003)
• CVE-2014-2273 (T1566.002)
• CVE-2015-4902 (T1547.008)
• CVE-2015-2387 (T1566.002)
• CVE-2009-3129 (T1547.008)
• CVE-2011-1255 (T1566.002)
• CVE-2013-5990 (T1547.008)
• CVE-2017-8570 (T1547.008)
• CVE-2012-0611 (T1059.012)
• CVE-2015-2419 (T1059.012)
• CVE-2016-0189 (T1059.012)
• CVE-2016-4117 (T1218.001)
• CVE-2017-0001 (T1547.008)
• CVE-2017-7255 (T1566.002)
• CVE-2017-0143 (T1547.008)
• CVE-2023-1389 (T1547.008)
• CVE-2025-13335 (T1566.002)
• CVE-2025-13927 (T1566.002)
• CVE-2025-13928 (T1566.002)
• CVE-2025-24893 (T1547.008)
• CVE-2025-31125 (T1183)
• CVE-2025-34026 (T1218.001)
• CVE-2025-54313 (T1218.001)
• CVE-2025-55183 (T1566.002)
• CVE-2025-55184 (T1087.004)
• CVE-2025-68645 (T1566.002)
• CVE-2026-0723 (T1098.007)
• CVE-2026-1102 (T1566.002)
• CVE-2026-20127 (T1183)
• CVE-2014-3897 (T1059.012)
• CVE-2025-66478 (T1547.008)
• CVE-2015-6585 (T1175)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る