Skip to content

RedCurl

IntrusionSet · ATTACK:enterprise:G1039

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1039",
  "title": "RedCurl",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1039",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--82323c70-4186-4b61-94f5-b227c3b28e89",
  "external_id": "G1039",
  "domain": "enterprise",
  "created": "2024-09-23T21:32:19.337Z",
  "modified": "2026-07-31T18:48:05.317Z",
  "version": "1.0",
  "aliases": [
    "RedCurl"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "group-ib_redcurl1",
      "url": "https://www.group-ib.com/resources/research-hub/red-curl/"
    },
    {
      "source_name": "group-ib_redcurl2",
      "url": "https://www.group-ib.com/resources/research-hub/red-curl-2/"
    }
  ]
}

Explicit source assertions (41)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06fbdb2f-97d5-4140-9300-0a1f6ab72cb2

therecord_redcurl · group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b200c14-5808-4cec-a1a4-aadf737fb99e

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--133dc9d4-f21b-40eb-be0c-6ea82fed2bef

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c54cdd2-576a-4ba5-9cf2-33bda233e018

group-ib_redcurl1

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fe3ccfb-2ed1-412f-af7e-c63821a5e434

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1080

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29282003-9cf6-4cdf-b87d-92dfcf2b1d52

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a58bdf1-2421-434d-938a-28d096f31736

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--353717ce-2c78-4752-941e-439421ec2448

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42430a20-2bc2-4078-9da6-9c065cbf5224

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47ad4b99-a600-4788-b90d-ba8e2799107a

therecord_redcurl · group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4aeffb05-327d-4ed3-a26f-e8eb7fe28055

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bf29716-d465-431c-9c45-f2b7a213cdec

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5df34449-b814-4580-a32c-d02f25cd8fe4

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f338678-212e-4940-b0f1-79b14d8c8c96

group-ib_redcurl1 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--676efaa5-591b-46b3-abb2-a0b308e037db

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d7ac1b0-acaa-4828-8863-9efda8f79589

trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7038419d-7138-436c-9486-5a800579a67f

group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73c503e1-dfa2-4aa4-8fbc-a5118fe96adf

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1087.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--752b1a33-be8b-4ae6-92ac-70b3e066a776

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a054a81-bee9-4429-b00e-0c45c88f06d0

therecord_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80b0aa57-f6cc-411c-8c54-65fad30f8143

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1056.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--824d51cd-f599-4a1d-afb1-4b3a51032d54

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85c97a8c-75ff-4469-bcc4-28c64a928390

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86a6b769-470e-4aa4-a285-2559af72a21b

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8880820c-e8c7-4dc5-9399-e9d619e38bfa

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90479403-5ebb-499d-a407-11b0fcd9c911

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94149a91-d3c4-4893-938d-4f8964aeb5d7

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4ec9b64-726b-4f6e-9115-98653d2bf8d4

therecord_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1537

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abbf5417-5112-424d-85f4-e4622675b319

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1202

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c23b4166-ede8-4ad6-bb31-40ce550a4107

trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8909d65-f9e1-41ba-a9d9-c47dbf03d588

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc2b70ee-b46c-4f92-a3b9-131ed098fe55

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd71b4dd-c049-47d4-bd0c-04f3a36d23e2

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2187598-ade7-4ce0-8375-da55aa3369c2

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1552.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4b8717c-a2bf-43af-b48f-8ef57bd6d36f

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d667d9d6-518a-4854-90db-c1661aba2130

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d97c5cd6-97e9-4684-a598-1e31406c7e2c

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcb0f1a0-18e5-47e0-ab2a-324aca7f89ba

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5cf97c0-5229-4d94-bd23-9dfa1517d8b3

trendmicro_redcurl

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4852627-bc4c-41d7-bcd5-09e90ae0f13c

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa87affe-1703-48c9-adc7-14bf52d0cc14

trendmicro_redcurl

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.