CURIUM
IntrusionSet · ATTACK:enterprise:G1012
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1012",
"title": "CURIUM",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1012",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--3ea7add5-5b8f-45d8-b1f1-905d2729d62a",
"external_id": "G1012",
"domain": "enterprise",
"created": "2023-01-13T20:51:13.494Z",
"modified": "2026-07-31T18:47:50.794Z",
"version": "3.0",
"aliases": [
"CURIUM",
"Crimson Sandstorm",
"TA456",
"Tortoise Shell",
"Yellow Liderc"
],
"tactics": [
],
"source_references": [
{
"source_name": "Crimson Sandstorm"
},
{
"source_name": "Tortoise Shell"
},
{
"source_name": "TA456"
},
{
"source_name": "Yellow Liderc"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA456 Defense Contractor July 2021",
"url": "https://www.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-targets-defense-contractor-alluring-social-media"
},
{
"source_name": "Microsoft Iranian Threat Actor Trends November 2021",
"url": "https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"
},
{
"source_name": "PWC Yellow Liderc 2023",
"url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"
},
{
"source_name": "Symantec Tortoiseshell 2019",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06a1f6f9-0695-47e6-bf1b-363d435d0bb2
Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08cdde30-5009-43bf-ad02-9330e7bfd0a7
Symantec Tortoiseshell 2019ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24021025-b5db-4ebb-89cb-49fe5c4d709e
Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1584.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48e14644-3ca8-4280-977b-50a6808a707f
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61fc1735-c822-497a-8d6e-ced7fd4e1a8a
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6600e60d-666f-4d7a-8e30-d4361f892a9f
Symantec Tortoiseshell 2019ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67b2064e-4e0b-4b56-8381-ed16efc270c2
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1048.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6aef256e-e914-42d3-af4a-3be735cf3fe3
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fad7038-4d0f-48c3-937a-7128d4bf0592
Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fc8e3dd-1bb7-4e76-8a8c-9e836f944488
Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e1510d2-b080-40a9-af8d-06e6b30a796b
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83c913fb-b9e4-4468-b3e2-976d59e32e9c
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb2d9a64-c36c-4998-9d31-5ad25629d288
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bff4fc3f-9d4d-404f-996c-eaae6426eb0d
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4545a14-77d8-4662-a773-648103524097
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:S1152
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5dff5a5-ccd5-4cc4-afcf-ec2b9d6556e1
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd909ab4-9160-4194-9213-7478189936e0
Symantec Tortoiseshell 2019ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea01b16f-5bd1-4443-be97-c523704f161c
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--effc0ed6-b472-48ab-99b6-2d3b553f4253
PWC Yellow Liderc 2023ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1583.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc8c8854-724f-4f2b-a297-1ae56c8726fd
PWC Yellow Liderc 2023