Newly discovered APT group RedCurl offering hack-for-hire services, report warns

Group focused on commercial organizations likely to be paid-for hackers

Security researchers have uncovered the existence of a previously unknown APT group dubbed RedCurl, which focuses on corporate espionage.

Since the earliest detected attack in May 2018, RedCurl has targeted victims all over the world including in Russia, Ukraine, UK, Germany, Canada, and Norway.

The group has carried out at least 26 targeted attacks on commercial organizations alone, including firms in the fields of construction, finance, consulting, retail, banking, insurance, law, and travel.

During its varied campaigns, RedCurl’s main goal was to steal confidential corporate documents such as contracts, financial documents, employee personal records, and records of legal actions and facility construction, says threat intelligence researchers Group-IB.

Tactics involve spear phishing campaigns followed up by the deployment of customized malware.

The group – whose methodology mimics those of legitimate red team pen testers – often uses a trojan downloader called RedCurl.Dropper, a password extractor called LaZagne, and Windows PowerShell scripts.

Malicious hackers then upload the data to legitimate cloud-based storage services.

In total, Group-IB has identified 14 organizations that fell victim to RedCurl's espionage, some on several occasions. Each of the victims have been contacted by the threat intelligence firm.

Mercenaries

Group-IB suggests that RedCurl is likely operating as a hacking-for-hire model.

“Our hypothesis is that their attacks might have been commissioned for the purpose of corporate espionage,” Oleg Skulkin, senior digital forensics analyst at Group-IB told The Daily Swig.

“First, they don’t have a clear geographical focus – they attack companies in Russia, Ukraine, the United Kingdom, Germany, Canada, and Norway. Unlike state-sponsored attackers, they don’t attack government organizations or critical infrastructure facilities.”

Skulkin continued: “We haven’t seen other corporate espionage-focused threat actors with a similar set of tactics, techniques, and procedures, but we found their techniques quite similar to campaigns called Cloud Atlas – but those targeted government entities rather than a corporate segment.”