Loading story…
Group-IB reported renewed activity by RedCurl, a Russian-speaking cyber-espionage group focused on stealing internal corporate documents from organizations across multiple industries. The company said the actor carried out four additional intrusions after a seven-month lull, raising the total number of observed attacks to 30, with activity tracked from 2018 through 2021. RedCurl’s operations were described as long-running and covert, typically lasting two to six months inside victim environments.
Investigators said the group relied on spear-phishing emails disguised as HR communications and used an expanded five-stage infection chain that now includes the FSABIN reconnaissance tool and a PowerShell downloader. Group-IB said RedCurl continues to favor self-developed malware over common post-exploitation frameworks, with campaigns aimed at exfiltrating sensitive business, legal, and personnel records rather than deploying ransomware or stealing money.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
BI.ZONE Cyber Threat Intelligence published analysis of a RedCurl (Red Wolf) campaign using an optical disk image with an LNK file and hidden DLLs to launch rundll32 and download the RedCurl.FSABIN backdoor from amscloudhost infrastructure. The report also detailed persistence via a scheduled task, anti-virtualization checks, host reconnaissance, follow-on DLL execution, and campaign IOCs including domains and SHA-256 hashes.
Since the beginning of 2021, RedCurl conducted four more attacks, bringing Group-IB's total observed count to 30. One victim was a Russian wholesale company that was attacked twice, while two other 2021 victims' locations were unknown.
After a seven-month lull, RedCurl resumed operations in 2021. Group-IB said the renewed activity marked a new phase in the threat actor's corporate espionage campaign.
Between 2018 and 2020, RedCurl carried out at least 26 corporate espionage attacks against organizations in sectors including construction, finance, consulting, retail, insurance, and law. Group-IB identified 14 victim organizations across countries including the UK, Germany, Canada, Norway, Russia, and Ukraine.
Group-IB published a report detailing renewed RedCurl activity, its updated tooling, and its continued focus on stealing internal corporate documentation rather than deploying ransomware or stealing funds. The report characterized RedCurl as a rare example of commercial corporate cyber espionage.
Analysis of RedCurl's latest attacks showed its kill chain had grown from three stages to five. The updated toolset included the FSABIN reconnaissance tool and a PowerShell downloader, reflecting an evolution in the group's tactics and malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-speaking threat group **OldGremlin** carried out a series of ransomware and spearphishing attacks against organizations in Russia, an unusual targeting pattern for a financially motivated group operating in the region. Group-IB linked at least seven phishing campaigns since spring 2020 to the actor, with lures tied to **COVID-19**, media outreach, and the Belarus protests, while impersonating entities including **RBC**, **SRO MiR**, **Novadent**, **Minsk Tractor Works**, and a metallurgical company. Reported victims included a large medical company as well as banks and industrial firms. In one documented intrusion, attackers used a phishing email masquerading as RBC to gain initial access, then deployed custom malware including **TinyNode** and **TinyPosh**, followed by **Cobalt Strike** for post-exploitation. The group established persistence through registry run keys, executed PowerShell and JScript, stole credentials, moved laterally over **RDP** and **SMB**, wiped backups, and finally encrypted the network with **TinyCryptor** ransomware. Group-IB said the operation also used Tor-based command-and-control infrastructure, APC-based process injection, and **RC4**-encrypted communications, aligning the activity with multiple **MITRE ATT&CK** techniques.
Aug 14, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026