How can organisations defend against RedCurl?

How RedCurl intrusions usually succeed

redcurl is not usually a noisy ransomware-style campaign. The practical issue is quiet access, followed by document theft and controlled exfiltration, so defenders should think in terms of account abuse, collection activity and low-and-slow staging rather than obvious destructive malware. That means email, browser, cloud and endpoint controls all matter because the group’s value comes from getting to business documents without triggering immediate alarms.

One useful way to frame the problem is to treat the initial foothold and the later collection phase as separate detection problems. The first question is whether a user or service account was coerced, harvested or reused in a way that gave the intruder access; the second is whether that access was then used to enumerate files, compress archives or move data out through approved channels.

Controls that reduce RedCurl’s room to operate

Defence works best when the environment makes credential theft less useful and document access more observable. Threat Actor Groups Guide is a useful reference point for understanding how group naming, aliases and campaign tracking help defenders connect activity to a broader intrusion pattern rather than treating each alert as isolated noise. In practice, that means enforcing multifactor authentication, tightening conditional access, and reviewing which identities can reach email, cloud services and shared document stores.

Limit macro and script execution where business workflows allow it, because document-driven intrusion chains often rely on a user opening content that then launches a second stage or enables file staging. Pair that with application control and endpoint telemetry so unusual archive creation, scripted compression and bulk file access are visible as behaviours, not just as single events.

External transfer controls matter as much as endpoint hardening. If data theft is the end goal, defenders need alerts for unusual use of cloud sync clients, personal storage, newly seen transfer destinations and repeated access to document repositories from a short-lived or unfamiliar session. The point is to catch collection patterns early, before the actor has enough material to make the exfiltration worthwhile.

What to investigate when the pattern looks suspicious

When you see archive spikes, file staging or odd outbound movement, look backwards into the identity trail and forwards into the endpoint trail. Review sign-in history, MFA prompts, impossible travel, token refreshes, unusual OAuth consent, mailbox forwarding changes and access to high-value document locations. On the endpoint, check for script hosts, archive utilities, temporary directories, renamed files and processes that accessed large numbers of documents in a short period.

For this kind of actor, the most important question is often not whether malware was dropped, but whether the account was quietly used to read and package sensitive material. That makes document repositories, email accounts and cloud file stores the priority evidence sources, especially when activity occurs outside normal business hours or from a system that normally has a narrow role.

Risk and Threat Considerations

RedCurl-style activity is risky because it can stay inside normal business tooling for a long time. If identity controls are weak or document access is too broad, an intruder can collect sensitive material without triggering the kind of obvious disruption that would force an early response.

Failure mechanism: Stolen or abused credentials, combined with overly permissive access to mail, cloud storage or document shares, let the actor stage archives and move files through legitimate services while blending into routine activity.

Impact: The organisation can lose confidential documents, investigation time and response options at the same time, because the earliest reliable signs are often behavioural rather than destructive.

Practitioner Guidance

What to verify: Confirm which identities can reach the document systems that matter most, then check whether MFA, conditional access and session controls are actually enforced for those accounts. Also verify that archive creation, script execution and external transfer events are visible in your logs rather than only on the endpoint.

Decision rule: If suspicious file staging is tied to a privileged or document-rich account, prioritise account containment and credential review before spending time on malware family attribution. The practical question is whether the actor can still read, package or move data.

Practitioner takeaway: For RedCurl, the winning move is to make quiet access harder to sustain and easier to prove, because the campaign is most dangerous when identity abuse and document theft look like ordinary work.

Related resources from NHI Mgmt Group

• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?