The Russian-speaking hacking group referred to as RedCurl has been linked to a ransomware marketing campaign for the primary time, marking a departure within the risk actor’s tradecraft.
The exercise, observed by Romanian cybersecurity firm Bitdefender, includes the deployment of a never-before-seen ransomware pressure dubbed QWCrypt.
RedCurl, additionally referred to as Earth Kapre and Crimson Wolf, has a historical past of orchestrating company espionage assaults geared toward varied entities in Canada, Germany, Norway, Russia, Slovenia, Ukraine, the UK, and the US. It is recognized to be energetic since no less than November 2018.
Assault chains documented by Group-IB in 2020 entailed using spear-phishing emails bearing Human Sources (HR)-themed lures to activate the malware deployment course of. Earlier this January, Huntress detailed assaults mounted by the risk actor focusing on a number of organizations in Canada to deploy a loader dubbed RedLoader with “easy backdoor capabilities.”
Then final month, Canadian cybersecurity firm eSentire revealed RedCurl’s use of spam PDF attachments masquerading as CVs and Cowl letters in phishing messages to sideload the loader malware utilizing the official Adobe executable “ADNotificationManager.exe.”
The assault sequence detailed by Bitdefender traces the identical steps, utilizing mountable disk picture (ISO) information disguised as CVs to provoke a multi-stage an infection process. Current inside the disk picture is a file that mimics a Home windows screensaver (SCR) however, in actuality, is the ADNotificationManager.exe binary that is used to execute the loader (“netutils.dll”) utilizing DLL side-loading.
“After execution, the netutils.dll instantly launches a ShellExecuteA name with the open verb, directing the sufferer’s browser to https://safe.certainly.com/auth,” Martin Zugec, technical options director at Bitdefender, stated in a report shared with The Hacker Information.
“This shows a official Certainly login web page, a calculated distraction designed to mislead the sufferer into considering they’re merely opening a CV. This social engineering tactic offers a window for the malware to function undetected.”
 |
| Picture Supply: eSentire |
The loader, per Bitdefender, additionally acts as a downloader for a next-stage backdoor DLL, whereas additionally establishing persistence on the host by way of a scheduled process. The newly retrieved DLL is then executed utilizing Program Compatibility Assistant (pcalua.exe), a method detailed by Development Micro in March 2024.
The entry afforded by the implant paves the best way for lateral motion, permitting the risk actor to navigate the community, collect intelligence, and additional escalate their entry. However in what seems to be a serious pivot from their established modus operandi, one such assault additionally led to the deployment of ransomware for the primary time.
“This centered focusing on may be interpreted as an try and inflict most injury with minimal effort,” Zugec stated. “By encrypting the digital machines hosted on the hypervisors, making them unbootable, RedCurl successfully disables all the virtualized infrastructure, impacting all hosted providers.”
The ransomware executable, in addition to using the deliver your personal weak driver (BYOVD) method to disable endpoint safety software program, takes steps to collect system data previous to launching the encryption routine. What’s extra, the ransom word dropped following encryption seems to be impressed by LockBit, HardBit, and Mimic teams.
“This follow of repurposing current ransom word textual content raises questions in regards to the origins and motivations of the RedCurl group,” Zugec stated. “Notably, there isn’t a recognized devoted leak website (DLS) related to this ransomware, and it stays unclear whether or not the ransom word represents a real extortion try or a diversion.”
