Threat actor · G1012

CURIUM

Crimson SandstormTA456Tortoise ShellYellow Liderc

UnattributedNo public state or group attribution on record

CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware.

MITRE ATT&CK Techniques

T1005 T1041 T1048.002 T1059.001 T1082 T1124 T1189 T1204.002 T1505.003 T1566.001 T1566.003 T1583.001 T1583.003 T1583.004 T1584.006 T1585.001 T1585.002 T1598.003 T1608.004

Associated Malware

IMAPLoader

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.