The Russian-speaking hacking group known as RedCurl has been linked to a ransomware marketing campaign for the primary time, marking a departure within the menace actor’s tradecraft.
The exercise, noticed by Romanian cybersecurity firm Bitdefender, entails the deployment of a never-before-seen ransomware pressure dubbed QWCrypt.
RedCurl, additionally known as Earth Kapre and Pink Wolf, has a historical past of orchestrating company espionage assaults aimed toward numerous entities in Canada, Germany, Norway, Russia, Slovenia, Ukraine, the UK, and the US. It is identified to be lively since at the very least November 2018.
Assault chains documented by Group-IB in 2020 entailed the usage of spear-phishing emails bearing Human Sources (HR)-themed lures to activate the malware deployment course of. Earlier this January, Huntress detailed assaults mounted by the menace actor focusing on a number of organizations in Canada to deploy a loader dubbed RedLoader with “easy backdoor capabilities.”
Then final month, Canadian cybersecurity firm eSentire revealed RedCurl’s use of spam PDF attachments masquerading as CVs and canopy letters in phishing messages to sideload the loader malware utilizing the professional Adobe executable “ADNotificationManager.exe.”
The assault sequence detailed by Bitdefender traces the identical steps, utilizing mountable disk picture (ISO) information disguised as CVs to provoke a multi-stage an infection process. Current throughout the disk picture is a file that mimics a Home windows screensaver (SCR) however, in actuality, is the ADNotificationManager.exe binary that is used to execute the loader (“netutils.dll”) utilizing DLL side-loading.
“After execution, the netutils.dll instantly launches a ShellExecuteA name with the open verb, directing the sufferer’s browser to https://safe.certainly.com/auth,” Martin Zugec, technical options director at Bitdefender, mentioned in a report shared with The Hacker Information.
“This shows a professional Certainly login web page, a calculated distraction designed to mislead the sufferer into pondering they’re merely opening a CV. This social engineering tactic gives a window for the malware to function undetected.”
 |
| Picture Supply: eSentire |
The loader, per Bitdefender, additionally acts as a downloader for a next-stage backdoor DLL, whereas additionally establishing persistence on the host via a scheduled process. The newly retrieved DLL is then executed utilizing Program Compatibility Assistant (pcalua.exe), a way detailed by Pattern Micro in March 2024.
The entry afforded by the implant paves the best way for lateral motion, permitting the menace actor to navigate the community, collect intelligence, and additional escalate their entry. However in what seems to be a serious pivot from their established modus operandi, one such assault additionally led to the deployment of ransomware for the primary time.
“This targeted focusing on might be interpreted as an try to inflict most harm with minimal effort,” Zugec mentioned. “By encrypting the digital machines hosted on the hypervisors, making them unbootable, RedCurl successfully disables your complete virtualized infrastructure, impacting all hosted companies.”
The ransomware executable, in addition to using the convey your personal susceptible driver (BYOVD) method to disable endpoint safety software program, takes steps to assemble system info previous to launching the encryption routine. What’s extra, the ransom observe dropped following encryption seems to be impressed by LockBit, HardBit, and Mimic teams.
“This observe of repurposing present ransom observe textual content raises questions concerning the origins and motivations of the RedCurl group,” Zugec mentioned. “Notably, there isn’t any identified devoted leak website (DLS) related to this ransomware, and it stays unclear whether or not the ransom observe represents a real extortion try or a diversion.”
