- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Islamic Revolutionary Guard Corps (IRGC)
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G1012 · 19 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0119 · curium
IranWhat it is
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Imperial Kitten, Tortoiseshell, Imperial Kitten
- Microsoft
- Crimson Sandstorm, Cuboid Sandstorm, DEV-0228, Smoke Sandstorm
- Proofpoint
- TA456
- Operations
- Operation “Fata Morgana”
- Other names
- Tortoiseshell, Cobalt Fireside, Devious Serpens, DUSTYCAVE, Houseblend, Marcella Flores, Tortoise Shell, Yellow Liderc
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- MicrosoftIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Europe, Israel, Middle East, Saudi Arabia, United Arab Emirates, United States
- Sectors
- Aerospace, Civil Society, Defense, Energy, Finance, Government, Healthcare, High-Tech, IT, Legal, Maritime and Shipbuilding, Media, Military, NGOs, Pharmaceuticals, Rail, Shipping and Logistics, Telecoms, Transportation
Tools
The tools and malware families the sources tie to it.
- Arabian-Attacker RAT
- IMAPLoader
- Remote Utilities
- RemoteCMD
- RemotePC
- StreamEx
- Trojan.Karagany
- Trojan.Mebromi
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de