New Cyber Threat: How RedCurl APT Uses 7-Zip for Covert Espionage

As cyber threats continue to evolve, one group stands out for its sophisticated approach to corporate espionage: RedCurl APT. Since at least 2018, this group has been actively conducting cyber espionage campaigns across the globe, targeting industries such as construction, finance, consulting, retail, banking, insurance, law, and travel. Their attacks have reached multiple countries, including Russia, Ukraine, the UK, Germany, Canada, and Norway. RedCurl is particularly focused on stealing confidential corporate documents, operating under a hack-for-hire model that suggests they conduct these campaigns for clients seeking competitive advantages.

One of the key tactics RedCurl employs is spear phishing. By sending emails that appear to come from legitimate HR staff or using company-specific details, they initiate their attacks effectively. Once a victim bites, RedCurl deploys customized malware through links embedded in these phishing emails. What’s particularly striking is that they utilize legitimate tools like PowerShell and 7-Zip, blurring the lines between standard practices and malicious activities. This approach allows them to manipulate and exfiltrate data without raising immediate suspicion. In fact, RedCurl has been noted for its use of sophisticated techniques to infiltrate private-sector firms, further enhancing its effectiveness.

The use of 7-Zip is particularly noteworthy. RedCurl archives stolen data with password protection, ensuring that even if the data is intercepted during transmission, it remains secure. By integrating 7-Zip with PowerShell scripts, they automate the process of data extraction and archiving, making their operations more efficient. Once the data is archived, they upload it to cloud storage services, further complicating detection efforts. This method not only ensures secure exfiltration but also leverages legitimate tools to evade security systems.

RedCurl’s operations, also known under the alias EarthKapre, include sophisticated phishing campaigns that often utilize job-themed emails. They sideload malicious loaders using legitimate Adobe executables and employ reconnaissance tools for network mapping. Their exfiltration methods include PowerShell PUT requests to cloud storage, showcasing their advanced capabilities.

The impact of RedCurl’s activities, particularly on the legal sector, has raised alarms. Organizations must be proactive in mitigating these threats. Implementing Group Policy to prevent unauthorized file mounting, deploying endpoint detection and response (EDR) solutions, and fostering continuous cyber vigilance are crucial steps.

Additionally, providing security awareness training for employees to recognize and report suspicious emails can significantly lower risk. Utilizing threat intelligence platforms can further aid in detecting and responding to RedCurl attacks before they escalate.