Procedure examples

CURIUM has exfiltrated data from a compromised machine.

CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.

CURIUM has used SMTPS to exfiltrate collected data from victims.

CURIUM has leveraged PowerShell scripts for initial process execution and data gathering in victim environments.

CURIUM deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.

CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.

CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.

CURIUM has lured users into opening malicious files delivered via social media.

CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.

CURIUM has used phishing with malicious attachments for initial access to victim environments.

CURIUM has used social media to deliver malicious files to victims.

CURIUM created domains to facilitate strategic website compromise and credential capture activities.

CURIUM created virtual private server instances to facilitate use of malicious domains and other items.

CURIUM has created dedicated servers for command and control and exfiltration purposes.

CURIUM has compromised legitimate websites to enable strategic website compromise attacks.

CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.

CURIUM has created dedicated email accounts for use with tools such as IMAPLoader.

CURIUM used malicious links to adversary-controlled resources for credential harvesting.

CURIUM used strategic website compromise to fingerprint then target victims.