Loading malware…
SCOUTCURL is a PowerShell-based reconnaissance and information-stealing tool used against Windows systems in Ukraine. It collects operating-system characteristics, installed-software information, files, and browser data, then exfiltrates the collected information to attacker-controlled infrastructure. This reconnaissance helps operators assess compromised systems and identify targets for further exploitation.
SCOUTCURL is associated with UAC-0145, a threat cluster within the Russian military intelligence-linked Sandworm group. It has been deployed in ClickFix infection chains using compromised websites that display fake CAPTCHA prompts. These prompts persuade visitors to paste and execute malicious PowerShell commands on their computers. SCOUTCURL can follow the GHETTOVIBE first-stage malware, while systems selected for continued compromise may receive additional loaders or backdoors. Persistence and follow-on remote access are provided by other components of the campaign rather than established capabilities of SCOUTCURL itself.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The downloaded code run on targeted computers runs a reconnaissance tool called ScoutCurl that collects information about the infected computer.
The downloaded code run on targeted computers runs a reconnaissance tool called ScoutCurl that collects information about the infected computer.
На наступному етапі ... може бути довантажений програмний засіб SCOUTCURL, що є PowerShell-сценарієм, який здійснює базову розвідку збираючи та ексфільтруючи інформацію про комп'ютер
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims visiting compromised websites are presented with a fake CAPTCHA security check and instructed to copy and paste a PowerShell command into their Windows computers.
CERT-UA researchers found ten websites hosting CAPTCHA pages that redirected users to web pages with malicious PowerShell commands.
It involves hosting CAPTCHA pages that mislead users into pasting PowerShell commands that execute malicious scripts on the targeted device.
...SCOUTCURL ... збираючи та ексфільтруючи інформацію про комп'ютер: ... дані Інтернет-браузерів...
the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data
SCOUTCURL software tool can be loaded onto the attacked computer... collecting and exfiltrating information about the computer: basic characteristics, programs, files, Internet browser data, etc.
the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data
SCOUTCURL software tool can be loaded onto the attacked computer... collecting and exfiltrating information about the computer: basic characteristics, programs, files, Internet browser data, etc.
...COWARDDUCK ... збір та ексфільтрацію інформації, у тому числі ... контактів, файлів ...; ... SCOUTCURL ... збираючи та ексфільтруючи інформацію...
...Згадана команда ... могла бути призначена для завантаження та збереження в каталозі автозапуску Startup VBS-файлу... На наступному етапі ... може бути довантажений програмний засіб SCOUTCURL...
the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data and exfiltrating the data to the attackers’ infrastructure.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.