PWC Yellow Liderc 2023

CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.

IMAPLoader uses WMI queries to query system information on victim hosts.

CURIUM has used SMTPS to exfiltrate collected data from victims.

IMAPLoader creates scheduled tasks for persistence based on the operating system version of the victim machine.

IMAPLoader uses the IMAP email protocol for command and control purposes.

IMAPLoader uses WMI queries to gather information about the victim machine.

IMAPLoader is a loader used to retrieve follow-on payload encoded in email messages for execution on victim systems.

IMAPLoader imports native Windows APIs such as `GetConsoleWindow` and `ShowWindow`.

CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.

CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.

IMAPLoader modifies Windows tasks on the victim machine to reference a retrieved PE file through a path modification.

IMAPLoader hides the Windows Console window created by its execution by directly importing the `kernel32.dll` and `user32.dll` libraries `GetConsoleWindow` and `ShowWindow` APIs.

CURIUM has used phishing with malicious attachments for initial access to victim environments.

IMAPLoader is executed via the AppDomainManager injection technique.

CURIUM created domains to facilitate strategic website compromise and credential capture activities.

CURIUM created virtual private server instances to facilitate use of malicious domains and other items.

CURIUM has created dedicated servers for command and control and exfiltration purposes.

CURIUM has compromised legitimate websites to enable strategic website compromise attacks.

CURIUM has created dedicated email accounts for use with tools such as IMAPLoader.

CURIUM used malicious links to adversary-controlled resources for credential harvesting.

CURIUM used strategic website compromise to fingerprint then target victims.