Full Report
Huntress discovered RedCurl activity across several organizations in Canada going back to 2023. Learn more about how this APT operates and how they aim to remain undetected while exfiltrating sensitive data.
Analysis Summary
# Threat Actor: RedCurl
## Attribution & Identity
* **Name/Alias:** RedCurl
* **Known Aliases:** Earth Kapre, Red Wolf
* **Known Associations:** Identified as an Advanced Persistent Threat (APT) group specialized in corporate espionage.
## Activity Summary
* **Recent Campaigns:** Activity detected in mid-to-late 2024, with some host telemetry dating back to November 2023.
* **Operational Scope:** Huntress identified three separate intrusions across three different organizations. The group is notable for its "quiet" approach, often remaining undetected for long periods without deploying ransomware or destructive payloads.
## Tactics, Techniques & Procedures
* **Execution via LOLBins:** Utilization of the **Windows Program Compatibility Assistant (pcalua.exe)** to execute malicious binaries and Python scripts, bypassing traditional execution monitoring.
* **Persistence:** Use of Scheduled Tasks to maintain a foothold and trigger the execution of proxy tools and scripts.
* **Proxying & C2:** Deployment of **RPivot**, specifically a modified script named `cl.py` (identical to `client.py` from the RPivot project), to establish connections to a remote server for Command and Control.
* **Scripting:** Extensive use of PowerShell for downloading secondary payloads (`.tmp` files) and batch scripts for automation.
* **Evasion:**
* Execution of 7zip binaries from suspicious/non-standard locations.
* Rapid deletion of malicious files/tools post-execution to minimize forensic footprints.
* Use of password-protected archives (7zip) for staging payloads to evade automated file analysis.
* **MITRE ATT&CK IDs (Inferred from context):**
* T1053.005 (Scheduled Task)
* T1218 (System Binary Proxy Execution - pcalua.exe)
* T1071.001 (Application Layer Protocol: Web Protocols)
* T1090 (Proxy)
* T1560 (Archive Collected Data)
## Targeting
* **Sectors:** Wholesale retail, finance, tourism, insurance, construction, and consulting.
* **Geography:** Recently active in **Canada**. Historically global.
* **Victims:** Multiple unnamed organizations fully or partially located in Canada.
## Tools & Infrastructure
* **Malware/Tools:**
* **RPivot:** Socks4 reverse proxy tool.
* **7zip:** Used for both unpacking malware and staging exfiltration.
* **Custom Batch/PowerShell:** For downloading `revtun1.tmp` and `revtun2.tmp`.
* **Infrastructure:**
* **Cloud Storage:** `bora.teracloud[.]jp/dav` (used for hosting payloads and likely exfiltration).
* **C2:** Remote servers facilitated through RPivot tunnels.
## Implications
RedCurl represents a sophisticated corporate espionage threat that eschews the high-profile disruption of ransomware for long-term data collection. Their focus on wholesale, finance, and construction suggests a goal of gathering sensitive business intelligence, contract details, and intellectual property. Their ability to adapt TTPs and use legitimate Windows utilities (pcalua.exe) makes them a difficult threat for signature-based detection systems to identify.
## Mitigations
* **Monitor LOLBins:** Implement detection rules for the unusual execution of `pcalua.exe`, especially when calling scripts or binaries in `AppData` or `Temp` directories.
* **Scheduled Task Auditing:** Monitor for the creation of new scheduled tasks that reference non-standard binaries or execute PowerShell commands.
* **Network Filtering:** Restrict or alert on traffic to known WebDAV and niche cloud storage providers (e.g., `teracloud[.]jp`) if there is no legitimate business need.
* **Endpoint Visibility:** Ensure the ability to capture and log transient files and command-line arguments, as RedCurl frequently deletes their toolset shortly after use.