CURIUM
Also tracked as Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.
- Documented techniques
- 19
- Assessed origin
- Iran
- Basis
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.
reconnaissance1
resource development7
initial access3
persistence1
collection1
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.