Threat intelligence / Group

CURIUM

[CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.(Citation: Symantec Tortoiseshell 2019) [CURIUM](https://attack.mitre.org/groups/G1012) has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://attack.mitre.org/groups/G1012) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.(Citation: Microsoft Iranian Threat Actor Trends November 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.(Citation: Symantec Tortoiseshell 2019) [CURIUM](https://attack.mitre.org/groups/G1012) has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://attack.mitre.org/groups/G1012) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.(Citation: Microsoft Iranian Threat Actor Trends November 2021)

20 recorded

Relationships

uses

to Data from Local System

Technique

uses

Technique

uses

to Drive-by Compromise

Technique

uses

to Drive-by Target

Technique

uses

to Email Accounts

Technique

uses

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

Malware

uses

to Malicious File

Technique

uses

Technique

uses

Technique

uses

to Social Media Accounts

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing via Service

Technique

uses

to System Information Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Virtual Private Server

Technique

uses

to Web Services

Technique

uses

Technique

10 external

References

mitre-attack

G1012

Crimson Sandstorm

—

Tortoise Shell

—

TA456

—

Yellow Liderc

—

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

Proofpoint TA456 Defense Contractor July 2021

https://www.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-targets-defense-contractor-alluring-social-media

Microsoft Iranian Threat Actor Trends November 2021

https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021

PWC Yellow Liderc 2023

https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html

Symantec Tortoiseshell 2019

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain