{
  "id": "redcurl",
  "name": "RedCurl",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Corporate espionage; allegedly Russian-speaking",
      "src": [
        "mitre-g1039"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2018,
      "src": [
        "mitre-g1039"
      ],
      "conf": "medium",
      "note": "At least 2018"
    },
    {
      "k": "attack_id",
      "v": "G1039",
      "src": [
        "mitre-g1039"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.",
      "src": [
        "mitre-g1039"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 41,
      "src": [
        "mitre-g1039"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1039)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/redcurl.html",
  "sources": {
    "mitre-g1039": {
      "title": "RedCurl, Group G1039",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1039/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}