RedCurl

Cybercriminal groupTrackedPending verification

CyberUNK

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeCybercriminal group

ProliferationOrigin country only

Active since2018At least 2018Med^[1]

MITRE ATT&CK IDG1039High^[1]

Capabilities

ATT&CK techniques used41ATT&CK v20.1High^[1]

Attribution and activity

Attributed sponsorCorporate espionage; allegedly Russian-speakingMed^[1]

TargetsRedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.Med^[1]

Notes

RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. RedCurl is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Sources

RedCurl, Group G1039, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1039)