AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G1039 · 41 ATT&CK techniques · 0 correlated reports

RedCurl

Aliases: None listed

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.

Open interactive actor investigation

ATT&CK techniques

T1027
Obfuscated Files or Information T1564.001
Hidden Files and Directories T1102
Web Service T1114.001
Local Email Collection T1039
Data from Network Shared Drive T1080
Taint Shared Content T1204.002
Malicious File T1005
Data from Local System T1119
Automated Collection T1083
File and Directory Discovery T1059.003
Windows Command Shell T1059.001
PowerShell T1036.005
Match Legitimate Name or Location T1566.001
Spearphishing Attachment T1059.005
Visual Basic T1560.001
Archive via Utility T1573.001
Symmetric Cryptography T1071.001
Web Protocols T1087.003
Email Account T1587.001
Malware T1087.001
Local Account T1056.002
GUI Input Capture T1082
System Information Discovery T1204.001
Malicious Link T1573.002
Asymmetric Cryptography T1053.005
Scheduled Task T1020
Automated Exfiltration T1199
Trusted Relationship T1537
Transfer Data to Cloud Account T1202
Indirect Command Execution T1552.001
Credentials In Files T1218.011
Rundll32 T1087.002
Domain Account T1566.002
Spearphishing Link T1552.002
Credentials in Registry T1070.004
File Deletion T1547.001
Registry Run Keys / Startup Folder T1555.003
Credentials from Web Browsers T1059.006
Python T1003.001
LSASS Memory T1046
Network Service Discovery

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research