RedCurlMalware
Last reported 13 months ago, by Huntress3 reports
ATT&CK techniques
6 of 13 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…emetry that the SOC looked at in this investigation also revealed that the threat actor gained access via a publicly accessible Remote Desktop Protocol (RDP) instance, and likely deployed the ransomware via UNC paths.”
- T1027Obfuscated Files or Information
“T1027.010Command ObfuscationUsed obfuscated powershell commands”
- T1036Masquerading
“T1036.004Masquerading: Masquerade Task or Service”
- T1036.004Masquerade Task or Service
“T1036.004Masquerading: Masquerade Task or Service”
- T1053.005Scheduled Task
“We discovered several scheduled tasks that were used to execute the”
- T1059Command and Scripting Interpreter
“T1059.001PowershellExecuted powershell scripts and commands”
What the reports say
3 reports, newest first · the exact sentence from each-
How EDR Telemetry Powers Managed Investigations“We also found that this activity matched closely with known TTPs from RedCurl, a known APT group.”
-
Tales of Too Many RMMs“For example, the Bitdefender blog post regarding RedCurl ransomware describes the initial access vector as a phishing email with an attached .img file; when a user double-clicks this file, by default, Windows will automatically mount and open the file, presenting the user with wh…”
-
Hunt for RedCurl“Hunt for RedCurl”
Indicators in its reports
named in the reports above- bora.teracloud[.]jpin 1 report
- 193.176.158[.]30in 1 report
- 188.130.207[.]253in 1 report
- mainsts-01.cn.alphastoned[.]proin 1 report
- 172.67.214[.]172in 1 report
- 104.21.37[.]229in 1 report
- 23.254.224[.]79in 1 report
- alphastoned[.]proin 1 report
- ihateregex[.]ioin 1 report
- 8117e40ee7f824f6…35aad3b83549in 1 report
- ea308c76a2f927b1…4e05164e716din 1 report
- 104.21.22[.]32in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.