What tactics and techniques does CURIUM use?

How CURIUM’s intrusion chain typically works

CURIUM’s activity is best understood as a delivery-to-persistence chain. The group combines email-based lures with weaponised documents, then uses those files to trigger code execution that stages additional tooling. The important practitioner takeaway is that the initial access path, the document interaction, and the later malware phase are linked, so defenders should treat them as one campaign rather than separate alerts.

The phish is not just a delivery vehicle. It is the mechanism that gets a user to open the document, which then hands control to the next stage. That pattern is common in targeted intrusion sets because it gives the operator a human-assisted entry point, a plausible execution trigger, and a path to install follow-on tooling without relying on a single obvious payload.

Because the campaign depends on staged execution, defenders should watch for a sequence rather than a single IOC: suspicious email delivery, file-open activity, script launch, loader behaviour, and then a process that begins to behave like an implant. The point is to correlate the chain, not to wait until the final malware beacon appears.

What the phishing and document stage is doing

The phishing layer is designed to create trust and urgency, while the malicious document provides the execution bridge. In practical terms, that means the first malicious event may be document rendering or macro-like behaviour, followed by script invocation, dropped files, or a secondary loader that brings in the operational malware. This is why simple attachment blocking is only a partial control if users can still be steered into opening active content.

A useful way to think about this stage is that the attacker is buying execution through social engineering. Once the file is opened, the payload can pivot from a passive document into an active chain that fetches or unpacks further components. When investigators only examine the final payload, they often miss the initial loader logic that explains how the compromise began.

Threat Actor Groups Guide is the right starting point if you need to place CURIUM in the wider actor landscape and understand how group intelligence is used to connect campaign activity over time.

How to interpret post-compromise behaviour

After the initial execution chain, CURIUM’s tooling is used to maintain access for surveillance and theft, so the later behaviour matters as much as the lure. Look for endpoints that begin making encrypted outbound connections when they normally do not, especially after a user interaction with a document. That combination suggests a successful handoff from document delivery to remote control or exfiltration-capable tooling.

The most useful distinction is between noisy user activity and a repeatable operator pattern. If a workstation opens a document, launches an unusual script or loader, and then begins sustained encrypted communications, you should treat that as a likely intrusion path rather than an isolated malware event. The technical issue is not only infection, but persistence and operator continuity.

Top 10 Phishing Techniques helps defenders map the email stage to known lure patterns, including attachment-led delivery and follow-on credential or session abuse.

Risk and Threat Considerations

CURIUM’s tactic set is risky because it blends human-targeted delivery with multi-stage malware, which reduces the value of any single control. If the email gets through, the document may still execute, and if endpoint controls miss the loader, the final implant can persist long enough for surveillance or theft. The threat is therefore a chained compromise, not a one-step malware drop.

Failure mechanism: The attacker relies on user interaction to trigger execution, then uses staged payloads and encrypted communications to blend into normal workflow and evade shallow inspection.

Impact: Organisations can lose confidentiality, operational visibility, and control over affected endpoints, while the compromise may remain active long enough to support monitoring, theft, or further lateral activity.

Practitioner Guidance

What to verify: Confirm whether the alert sequence includes email delivery, document open, script or loader launch, and outbound encrypted traffic from the same host. If those events line up, treat the incident as a campaign path, not a single malicious file.

Decision rule: If the document interaction is the execution trigger, prioritise endpoint triage and network containment before spending time on the exact lure theme. The key question is whether the host is already exhibiting loader behaviour or staged outbound communication.

Practitioner takeaway: The most important judgement here is to correlate user-driven document activity with post-open execution and beaconing, because that sequence is what turns a phishing email into durable operator access.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?