Overview 202 indicators
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.
| domain | 198 | G1012-domain.txt |
| url | 4 | G1012.json |
Techniques 19 ATT&CK
Open in ATT&CK Navigator → or download the layer (19 techniques, layer 4.5)
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1059.001 PowerShell
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1505.003 Web Shell
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.004 Server
- T1584.006 Web Services
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1598.003 Spearphishing Link
- T1608.004 Drive-by Target
Software 1
Principal sources 7 reports
Ranked by how many of this actor's indicators each report brought in.
- 183otx.alienvault.com/pulse/60f07dd74b222a6b9cc38975
- 13crowdstrike.com/blog/imperial-kitten-deploys-novel-malw…
- 13otx.alienvault.com/pulse/65525ca657dbfce9173d57d2
- 4blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html
- 4otx.alienvault.com/pulse/5d8a3103b8713b840f1b13dd
- 2symantec.com/blogs/threat-intelligence/tortoiseshell…
- 2otx.alienvault.com/pulse/5d8201965473b98dbf01a84f
Timeline 202 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
crowdstrike.com/blog/imperial-kitten-deploys-novel-malw… · otx.alienvault.com/pulse/65525ca657dbfce9173d57d2
analytics-service.cloud analytics-service.online blackcrocodile.online cdn-analytics.co cdn.jguery.org cdnpakage.com fastanalizer.live fastanalytics.live jquery-cdn.online jquery-code-download.online jquery-stack.online prostatistics.live updatenewnet.com -
otx.alienvault.com/pulse/60f07dd74b222a6b9cc38975
1st-smtp2go.email 2nd-smtp2go.email 3rd-smtp2go.email 4th-smtp2go.email accounts.cam activesessions.me adobes.software alhds.net apppure.cf bahri.site bbcnews.email bitly.cam biturl.cx brdcst.email careeronestop.site cc-security-inc.email ccsecurity-mail-inc.email ccsecurity-mail-inc.services citymyworkday.com cityofberkeley.support cnbcnews.email cnnnews.global codejquery-ui.com com-account-challenge.email com-signin-v2.email comlogin.online comlogin.services copyleft.today crisiswatchsupport.shop datacatch.xyz dayzim.org dh135.world dollrealdoll.com dollrealdoll.online entrust.work erictrumpfundation.com facebookservices.gq fblogin.me fileblade.ga findcareersatusbofa.com fiservcareers.com goodreads.rest googl.club gropinggo.com hex6mak5z98nubb9vpd6t36cydkncfci9im872qx6hjci2egx8irq3qyt9pj.online hike.studio hosted-microsoft.com iemail.today incognito.today infoga.cam iqtel.org irtreporter.com itiee.life itieee.life jessicamcgill.life jqueryui-code.com jumhuria.com kartick.net kaspersky.team linkgen.me linksbit.com linq.ink liveleak.cam liveuamap.live lockheedmartinjobs.us loginaccount.email logonexchangeonline.com logonmicrosoftonline.com lskjirn.life mail2go.live mail2go.online mail2u.live mailaccountlive.email mailaccountlive.support mailpublisher.live mails.center metacafe.live micorsoftonilne.com micorsoftonline.website micorsoftonline.xyz microsoftoffice.systems microsoftonilne.cloud mispace.cam msol.live msonline.live mssecurityaccount.online mydomainxyz.xyz news-smtp2go.email newsl.ink noreplay.email novafile.tk onpointcorp.co outlook-services.com outlookservices.live outlookservices.me outube.live pic-shareonline.com pixlr.live post-jquery.com prefiles.ml publicsgroupe.net pwutc.live rali.live recruitme.international robotics.land sabic.work sandsngo.com saudivisions2030.org securityaccountreply.com seery.online sendblaster.org shareae.cf shlink.run shlnk.run short-l.link shortli.live shrt.rip shur.live shurl.site site1.life smtp-2go.com smtp2go.best smtp2go.club smtp2go.email smtp2go.fun smtp2go.icu smtp2go.live smtp2go.me smtp2go.pw smtp2go.site smtp2go.space smtp2go.website smtper.center smtptogo.pw soc-usa.email soundcloud.fun soundcloud.live src-ymlang.link support-securitymail.email support-ymail-team.online surl.ist surl.live sxk8xrjtaikv3dxl7hgghw3vptvxpzzxeynrcltu4k3yeecjq3.online systembackend.site techmahindra.support teleweb.world tetra.email thegardian.ml thegaurdian.live thomsonsreuters.email thomsonsreuters.eu thomsonsreuters.link thomsonsreuters.net tinil.ink tinly.me tinylink.pro tinyurl.gold tiwpan.xyz tox.cheap treasury.email treporter.com trumphotel.net trumpnationallosangeles.email trumporganization.world trumporganizations.com tv-youtube.com uploaderfile.cf usdailypost.com usdailypost.net usdp.news vps.limited watch-youtube.com wikileaks.email workshopplatform.network xn--rumphotels-vcc.com xn--twitte-u9a.com xyzsitexyz.xyz ymail-account.support ymail-security-support.email ymail-security.support ymailaccounts.us ymailsupport.info zain.network -
blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html · otx.alienvault.com/pulse/5d8a3103b8713b840f1b13dd
domain hiremilitaryheroes.com domain spreadme.international url http://199.187.208.75 url http://66.42.78.193 -
symantec.com/blogs/threat-intelligence/tortoiseshell… · otx.alienvault.com/pulse/5d8201965473b98dbf01a84f
http://64.235.60.123 -
symantec.com/blogs/threat-intelligence/tortoiseshell… · otx.alienvault.com/pulse/5d8201965473b98dbf01a84f
http://64.235.39.45
Further reading 13
- attack.mitre.org/groups/G1012
- learn.microsoft.com/en-us/microsoft-365/security/intelligen…
- symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell…
- microsoft.com/en-us/security/blog/2021/11/16/evolving…
- proofpoint.com/us/blog/threat-insight/i-knew-you-were-…
- pwc.com/gx/en/issues/cybersecurity/cyber-threat…
- otx.alienvault.com/pulse/5d8a3103b8713b840f1b13dd
- crowdstrike.com/blog/imperial-kitten-deploys-novel-malw…
- blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html
- otx.alienvault.com/pulse/5d8201965473b98dbf01a84f
- otx.alienvault.com/pulse/65525ca657dbfce9173d57d2
- symantec.com/blogs/threat-intelligence/tortoiseshell…
- otx.alienvault.com/pulse/60f07dd74b222a6b9cc38975