Trusted Design

RedCurl

アクターID: G1039

· MITRE Pageへのリンク

脅威アクターの詳細

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.(Citation: group-ib_redcurl1) RedCurl is allegedly a Russian-speaking threat actor.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2) The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.

脅威アクターの別名・別称

RedCurl

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1583 - Acquire Infrastructure
• T1218.013 - Mavinject
• T1587.003 - Digital Certificates
• T1606.002 - SAML Tokens
• T1587.001 - Malware
• T1087.002 - Domain Account
• T1591.003 - Identify Business Tempo
• T1071.005 - Publish/Subscribe Protocols
• T1592.001 - Hardware
• T1543.003 - Windows Service
• T1598.003 - Spearphishing Link
• T1487 - Disk Structure Wipe
• T1608.004 - Drive-by Target
• T1120 - Peripheral Device Discovery
• T1558.005 - Ccache Files
• T1584.003 - Virtual Private Server
• T1016.002 - Wi-Fi Discovery
• T1562.012 - Disable or Modify Linux Audit System
• T1546.005 - Trap
• T1090 - Proxy
• T1219.001 - IDE Tunneling
• T1612 - Build Image on Host
• T1051 - Shared Webroot
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1122 - Component Object Model Hijacking
• T1574.010 - Services File Permissions Weakness
• T1542.004 - ROMMONkit
• T1059.011 - Lua
• T1128 - Netsh Helper DLL
• T1027.004 - Compile After Delivery
• T1591.004 - Identify Roles
• T1055.009 - Proc Memory
• T1070.009 - Clear Persistence
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1209 - Time Providers
• T1105 - Ingress Tool Transfer
• T1027.018 - Invisible Unicode

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1051)
• CVE-2015-5749 (T1051)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2015-7262 (T1051)
• CVE-2015-0932 (T1051)
• CVE-2010-3081 (T1209)
• CVE-2017-16929 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-68645 (T1027.018)
• CVE-2014-4114 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2015-2546 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2014-1761 (T1598.003)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1027.018)
• CVE-2014-4113 (T1027.018)
• CVE-2012-1889 (T1587.003)
• CVE-2015-1641 (T1027.018)
• CVE-2017-0263 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2016-6532 (T1612)
• CVE-2017-3212 (T1587.003)
• CVE-2025-55182 (T1027.018)
• CVE-2013-3906 (T1059.011)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2013-2551 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2015-0057 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2015-0071 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2013-7331 (T1542.004)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1122)
• CVE-2010-0232 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2009-3129 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2011-0611 (T1591.004)
• CVE-2017-8570 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2017-0001 (T1027.018)
• CVE-2017-0143 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1051)
• CVE-2015-2852 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2015-2853 (T1027.018)
• CVE-2016-1287 (T1606.002)
• CVE-2016-1562 (T1612)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2016-4117 (T1219.001)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2010-1553 (T1027.018)
• CVE-2013-5990 (T1027.018)
• CVE-2015-0310 (T1219.001)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1219.001)
• CVE-2015-3456 (T1562.012)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-3628 (T1219.001)
• CVE-2015-6034 (T1051)
• CVE-2015-6022 (T1027.018)
• CVE-2016-2343 (T1612)
• CVE-2016-9496 (T1027.018)
• CVE-2012-0056 (T1562.012)
• CVE-2012-1258 (T1209)
• CVE-2014-3153 (T1219.001)
• CVE-2015-3636 (T1219.001)
• CVE-2013-6282 (T1219.001)
• CVE-2014-2273 (T1219.001)
• CVE-2025-13335 (T1562.012)
• CVE-2025-13927 (T1562.012)
• CVE-2025-13928 (T1562.012)
• CVE-2025-24893 (T1027.018)
• CVE-2026-1102 (T1562.012)
• CVE-2026-20127 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-3113 (T1219.001)
• CVE-2015-2590 (T1027.018)
• CVE-2016-1010 (T1027.018)
• CVE-2016-1019 (T1219.001)
• CVE-2016-0984 (T1027.018)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2012-3213 (T1027.018)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-4322 (T1219.001)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2017-17215 (T1027.018)
• CVE-2014-8439 (T1209)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2014-0556 (T1027.018)
• CVE-2015-5560 (T1219.001)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2014-7247 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2014-3393 (T1219.001)
• CVE-2015-4902 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-66478 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2015-7645 (T1027.018)
• CVE-2015-6585 (T1051)
• CVE-2025-54313 (T1051)
• CVE-2010-1297 (T1027.018)
• CVE-2010-2883 (T1209)
• CVE-2013-0641 (T1591.004)
• CVE-2014-8361 (T1556.005)
• CVE-2016-2342 (T1209)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2012-4681 (T1027.018)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る