Stealthy RedCurl hackers steal corporate documents

guest · Aug 13, 2020

Stealthy RedCurl hackers steal corporate documents
August 13, 2020
https://www.bleepingcomputer.com/news/security/stealthy-redcurl-hackers-steal-corporate-documents/

For the past couple of years, a little known cyberespionage group has been conducting carefully planned attacks against victims in a wide geography to steal confidential corporate documents.

In a short period, the crew launched at least 26 attacks targeting 14 organizations, all the while keeping a very low profile.
Subtle activity
Named RedCurl, the earliest known activity from this threat actor is group is from May 2018. The group is believed to be Russian speaking and was mentioned for the first time last year, in a report from Group-IB, a Singapore-based cybersecurity company.

Since then, the researchers documented the tactics, tools, and infrastructure used by RedCurl from multiple incident response engagements and published them in a report today.
Click to expand...

Attacks start with well-written phishing emails often impersonating human resource staff at the targeted organization. Sometimes the same message (e.g. about annual bonuses) was delivered to multiple individuals working in the department of the attacker’s interest.

Group-IB says that the group has strong social engineering skills, using the victim company’s domain name in the sender address and making the messages look legitimate with the official company logo.
RedCurl uses the MultCloud platform for managing and accessing the storage space from these services, which also serve command and control purposes via PowerShell scripts.
Click to expand...

RedCurl spends plenty of time inside a victim network, between two to six months, allowing them to sift through data of interest and move laterally with the lightest steps.
A technical report is now available from Group-IB, with indicators of compromise that could help organizations detect intrusions from this actor at an early phase.
Click to expand...

Group-IB: RedCurl

The APT group continues to successfully attack enterprise companies in North America, Europe, and CIS countries after remaining undetected for years. Their goal is carefully planned, targeted cyber espionage.
Click to expand...

guest · Nov 18, 2021

RedCurl corporate espionage hackers resume attacks with updated tools
November 18, 2021
https://www.bleepingcomputer.com/ne...ge-hackers-resume-attacks-with-updated-tools/

A crew of highly-skilled hackers specialized in corporate espionage has resumed activity, one of their victims this year being a large wholesale company in Russia.

Tracked as RedCurl, the group attacked the Russian business twice this year, each time using carefully constructed spear-phishing emails with initial-stage malware.
Increasing the victim count
Active since 2018, RedCurl is responsible for at least 30 attacks against businesses in Russia (18 of them), Ukraine, Canada, Norway, the UK, and Germany, the latest four of them occurring this year.
Click to expand...

Hitting the same company twice
Researchers at cybersecurity company Group-IB noticed a seven-month gap in RedCurl’s activity, which the hackers used to add significant improvements to their set of custom tools and attack methods.

For reasons that remain unknown, RedCurl attacked this company twice, gaining initial access via emails impersonating the company’s human resources department announcing bonuses and the government services portal.
Click to expand...

In both cases, the goal was to deploy on the employee’s computer a malware downloader (RedCurl.InitialDropper) hidden in an attached document that could launch the next stage of the attack.
During the investigation, Group-IB found that the RedCurl extended the attack chain to five stages, from the previously observed three or four steps.

The dropper would fetch the RedCurl.Downloader tool, which collected info about the infected machine and delivered it to a command and control server (C2), and also initiated the next stage of the attack.
Click to expand...

Updated toolset
Group-IB discovered that the hackers now used RedCurl.Extractor, a modified version of the RedCurl.Dropper they found in previous attacks from this threat actor.
However, the improvements to RedCurl’s toolset appear to have been rushed, as Group-IB discovered a logical error in one of the commands. One explanation is that the group had little time to start the attack and could not properly test their tools.

Group-IB has published a report today with indicators of compromise and technical information on RedCurl’s updated set of tools and their functionality: [...]
Click to expand...

Group-IB: RedCurl: The awakening

Commercial cyber espionage remains a rare and largely unique phenomenon. We cannot rule out, however, that RedCurl’s success could lead to a new trend in the cybercrime arena.
Click to expand...

Log in or Sign up

Stealthy RedCurl hackers steal corporate documents

guest Guest

guest Guest

Log in or Sign up

Stealthy RedCurl hackers steal corporate documents

guest Guest

guest Guest

Useful Searches