← All Threat Actors
Threat Actor Profile

CURIUM

Crimson Sandstorm G1012 TA456 Tortoise Shell Yellow Liderc
▲ High Threat
LinkedIn Job Recruitment Campaign, Western Aerospace and Defense Espionage, Maritime and Logistics Watering Hole Campaign
Origin Iran
Sponsor Islamic Revolutionary Guard Corps (IRGC)
Motivation Strategic cyber-espionage and intelligence collection to support Iranian geopolitical and military objectives.

Target Sectors

Defense Aerospace Telecommunications Maritime Shipping Logistics IT Managed Service Providers (MSPs) Regional Government Aviation

Known TTPs

Social Engineering via professional networks (LinkedIn)
Strategic Web Compromise (Watering Holes)
IMAP-based Command and Control (C2) using IMAPLoader
DLL Side-loading (e.g., SbieDll_Hook)
PowerShell for system reconnaissance and execution
Generative AI (LLMs) for refining phishing lures and debugging malware
Credential harvesting through deceptive websites
Spear-phishing with malicious PDF/Office attachments

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD