RedCurl

RedCurl is an espionage group also referred to as Earth Kapre and Red Wolf; GOLD BLADE is also associated in the provided content through reporting on the group’s custom RedLoader malware. The group has conducted phishing campaigns targeting organizations in Russia, Germany, Ukraine, the United Kingdom, Slovenia, Canada, Australia, and the United States. Reported tradecraft includes delivery via malicious files and LNK-based infection chains, including hiding original files with the hidden attribute to induce execution of malicious LNK files. RedCurl has used PowerShell and the Windows Command Prompt for execution, including Base64-encoded PowerShell commands and downloading malware. It has used batch scripts for collection and account discovery, including collecting data from local disks, gathering system information and network connection details, and enumerating domain accounts with Sysinternals AdExplorer. For credential access, RedCurl has used LaZagne to obtain passwords from files, and reporting also notes PyArmor-obfuscated LaZagne execution, string encryption, and encrypted data. For persistence, RedCurl has created Registry Run entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. For command and control, it has used HTTP, HTTPS, and WebDAV, and has also used cloud services to receive commands and transmit outputs. It has mimicked legitimate filenames and scheduled tasks such as MicrosoftCurrentupdatesCheck and MdMMaintenenceTask to mask malicious artifacts, and has deleted files after execution.