CURIUM
Threat actorAttributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- CURIUMOur name
- Crimson SandstormMicrosoft
- TA456Microsoft
- Tortoise ShellMicrosoft
- Yellow LidercPwC
Targets
Sectors: Media
Regions: Middle East
Source: MITRE ATT&CKKnown techniques
- T1005Data from Local System
- T1041Exfiltration Over C2 Channel
- T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1059.001PowerShell
- T1082System Information Discovery
- T1124System Time Discovery
- T1189Drive-by Compromise
- T1204.002Malicious File
- T1505.003Web Shell
- T1566.001Spearphishing Attachment
- T1566.003Spearphishing via Service
- T1583.001Domains
- T1583.003Virtual Private Server
- T1583.004Server
- T1584.006Web Services
- T1585.001Social Media Accounts
- T1585.002Email Accounts
- T1598.003Spearphishing Link
- T1608.004Drive-by Target
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.