Earth Kapre

Earth Kapre (RedCurl) is an APT group known for cyberespionage operations.

Analyst brief

Earth Kapre (RedCurl, Red Wolf, GOLD BLADE) is an APT group focused on cyberespionage. The group targets organizations across various countries, using spearphishing attachments for initial access. Key TTPs include execution via Windows Command Shell, persistence through Registry Run Keys, stealth using obfuscation and hidden files, credential theft from files and local email, and C2 communication via Web Services with symmetric cryptography. Defenders should strengthen email security gateways, monitor for anomalous process executions and registry modifications, and enhance monitoring of network share and email collection activities.

Earth Kapre

RedCurlRed WolfGOLD BLADE

unknown

Earth Kapre is an APT group specializing in cyberespionage. They target organizations in various countries through phishing campaigns using malicious attachments to infect machines. Earth Kapre employs techniques like abusing PowerShell, curl, and Program Compatibility Assistant to execute malicious commands and evade detection within targeted networks. The group has been active since at least 2018 and has been linked to multiple incidents involving data theft and espionage.

techniques · ATT&CK

Malware Spearphishing Attachment Windows Command Shell Malicious File Registry Run Keys / Startup Folder Obfuscated Files or Information Hidden Files and Directories Credentials In Files+8

source: misp-galaxy + mitre-attackG1039 5 refs →

Kill-chain playbook11

01
resource-development
T1587.001
Monitor file creation and modification activities to detect and mitigate malware development.
02
initial-access
T1566.001
Monitor email attachments and their execution to detect and mitigate Spearphishing Attachment attacks.
03
execution
T1059.003 T1204.002
Monitor process creation and command-line activities to detect and mitigate Windows Command Shell and malicious file execution.
04
persistence
T1547.001
Monitor Registry Run Keys and Startup Folder changes to detect and mitigate persistence.
05
stealth
T1027 T1564.001
Monitor file and directory attributes and content to detect hidden files and directories, as well as obfuscated information.
06
credential-access
T1552.001
Monitor file content and access activities to detect and mitigate credentials stored in files.
07
discovery
T1083 T1087.001
Monitor file and directory enumeration and account enumeration to detect file and directory discovery and local account discovery.
08
lateral-movement
T1080
Monitor access to and modifications of shared resources to detect and mitigate tainted shared content.
09
collection
T1039 T1114.001
Monitor file and email activities to detect data collection from network shared drives and local email collection.
10
command-and-control
T1102 T1573.001
Monitor network traffic and encryption activities to detect and mitigate command and control activities using web service and symmetric cryptography.
11
exfiltration
T1020
Monitor network traffic and data transfer to detect and mitigate automated exfiltration activities.

FAQ2

What type of cyber activity is the APT group Earth Kapre (RedCurl) primarily engaged in?

Earth Kapre is primarily engaged in cyberespionage.

What method does the Earth Kapre group use to gain initial access to target networks?

The group uses spearphishing emails with malicious attachments to gain initial access.

Earth Kapre

Analyst brief

Earth Kapre

Kill-chain playbook11

resource-development

initial-access

execution

persistence

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

exfiltration

FAQ2

See also6

Earth Kapre

Analyst brief

Earth Kapre

Kill-chain playbook11

resource-development

initial-access

execution

persistence

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

exfiltration

FAQ2

See also6