Loading threat actor…
RedCurl, also known as Earth Kapre, GOLD BLADE, and Red Wolf, is a Russian-speaking corporate cyberespionage group active since at least June 2018. It targets commercially sensitive documents, business correspondence, personnel records, and legal information. Known victims include banking, insurance, construction, consulting, retail, and legal organizations in Russia, the United Kingdom, Germany, Canada, Norway, Ukraine, and Australia. Its language does not establish a country of origin or state sponsorship. The group conducts targeted spear-phishing using messages impersonating internal human-resources departments, recognizable commercial brands, and freight companies. Lures commonly promise employee bonuses or discounts. Infection chains employ malicious disk images, document-themed Windows shortcuts, hidden files, and legitimate Windows utilities to execute custom malware. In a 2022 intrusion against a major Russian bank, RedCurl compromised a contractor and modified a shared document archive after direct phishing attempts were blocked, using the trusted business relationship to reach its target. RedCurl's modular toolset includes RedCurl.SimpleDownloader, RedCurl.Downloader, RedCurl.Extractor, and RedCurl.FSABIN. Its malware supports reconnaissance, staged payload delivery, remote command execution, and scheduled-task persistence. Evasion techniques include encrypted strings, anti-debugging and virtual-environment checks, hidden file attributes, and tasks masquerading as legitimate software components. The group uses LaZagne to extract passwords from browsers, files, and the Windows Registry, and employs custom tools for lateral movement and exfiltration. It also abuses cloud services to receive commands and transmit results. RedCurl's espionage operations emphasize stealth and extended access, with observed intervals of two to six months between initial compromise and data theft. Its documented campaigns focus on covert information collection rather than infrastructure encryption, ransom demands, or direct theft from bank accounts.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
112 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
16 malware families Mallory has associated with this actor across public reporting.
11 additional families tracked in Mallory.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
100 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.