CURIUM
- ID
- G1012
- Associated names
- Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.[1] CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note CURIUM has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.[2]
Techniques used (19)
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1059.001 PowerShell
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1505.003 Web Shell
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.004 Server
- T1584.006 Web Services
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1598.003 Spearphishing Link
- T1608.004 Drive-by Target