CuratorMalware
- ever101
- sunnyday
Profero describes this as a ransomware family using CryptoPP as library to enable file encryption with the Salsa20 algorithm and protecting the encryption keys with RSA2048.From MISP Galaxy
Last reported 10 days ago, by Risky Business News2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1014Rootkit
“XWorm now also includes a rootkit, a GPS location data harvester, and a webcam and microphone recording module—bringing it closer to a spyware strain than an infostealer.”
- T1098.003Additional Cloud Roles
“…reation of administrative accounts (T1136.003) is not unusual, they should always be investigated if unexpected to ensure cloud roles (T1098.003) are properly scoped.”
- T1114.003Email Forwarding Rule
“In this scenario we are focused on potential collection of sensitive information via email collection via an email forwarding rule (T1114.003)”
- T1136.003Cloud Account
“While the creation of administrative accounts (T1136.003) is not unusual, they should always be investigated if unexpected to ensure cloud roles (T1098.003) are properly scoped.”
- T1552Unsecured Credentials
“We will configure the GW integration settings to have information created when we set up our GW environment to avoid having unsecured credentials on our Ubuntu host.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“Threat/trend reports: Canadian government, Check Point, Cloud Security Alliance, Counterpoint, Curator, CyFirma, Dashlane, Flashpoint, Incogni, Nozomi Networks, and SEAL have recently published reports and summaries covering various emerging threats and industry trends.”
-
Google Workspace Attack Surface“Name: Curator”
Indicators in its reports
named in the reports above- dejesusarcheology[.]comin 1 report
- hxxps://www.googleapis[.]com/auth/admin.reports.audit.readonlyin 1 report
- admin.setting[.]namein 1 report
- katie-drummond.bsky[.]socialin 1 report
- ua[.]newsin 1 report
- alexmartin.bsky[.]socialin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.