Loading threat actor…
STAC6565 is a financially motivated threat activity cluster assessed with high confidence to overlap substantially with Gold Blade, also tracked as Earth Kapre, RedCurl, and Red Wolf. The actor has historically been associated with commercial espionage and later evolved into hybrid intrusion operations that combine data theft with selective ransomware deployment. Available reporting indicates the group is not state-sponsored and is consistent with a hack-for-hire or mercenary-style operating model. The actor has conducted a concentrated campaign against Canadian organizations since at least February 2024, while also targeting organizations in the United States, the United Kingdom, Australia, and multiple European countries. Observed victim sectors include government-adjacent and civil-society organizations as well as technology, manufacturing, retail, transportation, and broader business services environments. RedCurl is known for socially engineered initial access, especially spear-phishing directed at human resources and recruiting workflows. A recurring technique involves malicious resumes or cover letters, including lures delivered through legitimate recruitment platforms. The group has used multi-stage malware delivery chains featuring custom tooling such as RedLoader, along with DLL sideloading and later executable-based payload stages. Post-compromise activity includes host profiling, Active Directory reconnaissance, process and security-tool discovery, encrypted data collection and exfiltration, and use of tunneling utilities for command-and-control and internal access. The cluster has also demonstrated advanced defense-evasion and post-exploitation tradecraft. Reported operations include use of a customized Terminator utility in a bring-your-own-vulnerable-driver scheme to terminate security products, distribution of tooling across victim networks, and tailored scripts to disable recovery mechanisms and inhibit forensic reconstruction. In successful ransomware incidents, the actor deployed the custom QWCrypt ransomware, including against virtualized infrastructure and hypervisors, indicating capability to impact both endpoints and server estates. The actor’s pattern of delaying encryption in some cases to monetize stolen data first further supports a financially driven, opportunistic operating model. Known aliases and closely overlapping designations include Gold Blade, Earth Kapre, RedCurl, and Red Wolf.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.