RedCurl

Targets

Sectors: Finance

Regions: United Kingdom, Ukraine, Canada

Known techniques

• T1003.001LSASS Memory
• T1005Data from Local System
• T1020Automated Exfiltration
• T1027Obfuscated Files or Information
• T1036.005Match Legitimate Resource Name or Location
• T1039Data from Network Shared Drive
• T1046Network Service Discovery
• T1053.005Scheduled Task
• T1056.002GUI Input Capture
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.006Python
• T1070.004File Deletion
• T1071.001Web Protocols
• T1080Taint Shared Content
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087.001Local Account
• T1087.002Domain Account
• T1087.003Email Account
• T1102Web Service
• T1114.001Local Email Collection
• T1119Automated Collection
• T1199Trusted Relationship
• T1202Indirect Command Execution
• T1204.001Malicious Link
• T1204.002Malicious File
• T1218.011Rundll32
• T1537Transfer Data to Cloud Account
• T1547.001Registry Run Keys / Startup Folder
• T1552.001Credentials In Files
• T1552.002Credentials in Registry
• T1555.003Credentials from Web Browsers
• T1560.001Archive via Utility
• T1564.001Hidden Files and Directories
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1573.001Symmetric Cryptography
• T1573.002Asymmetric Cryptography