Huntress Details RedCurl-Linked Intrusions at Three Organizations in Canada

Mar 3, 2025 · Original article ↗

Summary

Huntress investigated three intrusions at organizations wholly or partly in Canada, linking activity to RedCurl through malware, infrastructure and tradecraft. Attackers used scheduled tasks, Python reverse proxies and cloud storage for suspected exfiltration.

Key points

Huntress uncovered the intrusions in mid-to-late 2024, with observed host activity dating back to November 2023; the initial infection method was not established.
Scheduled tasks resembling legitimate Windows tasks used pcalua.exe to launch malicious executables and Python scripts, providing persistence and indirect execution.
Python scripts matched the RPivot proxy tool and established reverse tunnels to remote IP addresses.
PowerShell scripts downloaded password-protected archives from bora[.]teracloud[.]jp/dav and uploaded collected files using HTTP PUT; 7zip encrypted archives and deleted original files.
A backdoor Huntress calls RedLoader used rolling XOR string decryption, dynamic DLL resolution and AES-related cryptographic routines to conceal functionality.
Shared infrastructure, distinctive script patterns and similarities to previously documented malware supported the RedCurl association, rather than definitive attribution.
Defensive guidance includes baselining pcalua.exe usage, reviewing Task Scheduler execution logs, and hunting Python network connections and suspicious PowerShell-to-7zip process chains.

Article Details

Attack Vectors: Initial access was not established; Huntress did not observe all intrusions from their beginning, and malware quickly deleted many files.
Scheduled tasks launched malicious executables and Python reverse-proxy scripts through pcalua.exe. Task names resembled legitimate Windows tasks.
Batch scripts used PowerShell HTTP GET requests to download password-protected archives, which were extracted with 7zip.
Python scripts matching RPivot established reverse-proxy connections to remote servers.
Scripts collected directory listings and running-process information, encrypted and archived output with 7zip, and uploaded files to cloud storage using PowerShell HTTP PUT requests.
RedLoader provided basic backdoor capabilities and concealed DLL and function names using encrypted strings and dynamic resolution.
Defensive Notes: Baseline legitimate pcalua.exe execution and investigate unusual use, especially scheduled tasks launching executables or Python scripts through it.
Enable Microsoft-Windows-TaskScheduler/Operational logging. Inspect event IDs 129, 200, and 201 for pcalua.exe in Path or ActionName fields. Event ID 129 records task execution, not task creation; Security Event ID 4698 typically records creation.
Extend the Scheduled Task Executed Uncommon LOLBin Sigma rule to include paths ending in \pcalua.exe.
Hunt for python.exe or pythonw.exe making network connections or receiving IP addresses in command-line arguments, while filtering established legitimate activity.
Investigate 7zip extraction of password-protected archives and archive creation combining password protection with the -sdel option.
Hunt for PowerShell spawning 7zip and correlate that activity with scheduled tasks, file collection, and outbound transfers.
Baseline normal scripting activity and retain process, command-line, network, and scheduled-task telemetry. Make hunting queries case-insensitive where supported.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`cdn[.]wgroadcdn[.]workers[.]dev`	Specific hosted hostname listed as proxy or C2 infrastructure in the article's network indicators.
HOSTNAME	`mainsts-01[.]cn[.]alphastoned[.]pro`	Hostname found in recovered files and linked by Huntress to infrastructure associated with RedCurl.
HOSTNAME	`sup[.]wgsphere[.]workers[.]dev`	Specific hosted hostname listed as proxy or C2 infrastructure in the article's network indicators.
IPV4	`188[.]130[.]207[.]253`	Remote reverse-proxy endpoint supplied to the Python cl.py script with port 10310.
IPV4	`193[.]176[.]158[.]30`	Remote RPivot endpoint stored in a recovered script with port 40141.
IPV4	`23[.]254[.]224[.]79`	Address associated with the observed malicious hostname; Huntress identified it as a connection to previously reported RedCurl infrastructure.
SHA256	`01d94de4d104f6df121f97bae9cbbfada5a9cd4c3af0e1c403271d8284815cad`	Hash of 9b1ab911.dat in the DiskCleanup directory, listed as an intrusion artifact.
SHA256	`1935692d1c4492f99c969d11d81481aea736f3899b1f55af9c8f6cf6ca9b839c`	Hash of 9b1aa6a9.dat in the USB directory, listed as an intrusion artifact in the IOC table.
SHA256	`4af2c0c6087f9410cf57af4cf7eb09b5a3038bb78f4e50625402e32ad9662e66`	Hash of the deployed cl.py script under ControlsUp; Huntress identified the script as matching RPivot client.py and used for reverse-proxy tunneling.
SHA256	`574a55706697d7e0109cf920ae6e0047cd7a802c9ad457e3b68e7802f3f902ef`	Hash of mbda76918700ee0725.exe, the malicious executable launched by the WiFiTask scheduled task.
SHA256	`5a8314cbdccc7362a100b9db92b05597dad37c13b4cbb7b0fd1ef58d625dd454`	Hash of 9b1a4231.dat in the Multimedia directory, listed as an intrusion artifact.
SHA256	`6d85ad9e14a23ed6bf700f636273b30f53c54267d0f624c8ff7bc0008f7db4f7`	Hash of 9b1a7691.dat in the WCM directory, listed as an intrusion artifact in the IOC table.
SHA256	`904669bd897dbb99561ef080d9818ff4bc9c106aa476d25b992439cdea4d1b0b`	Hash of om6db9110b3989a881.exe, launched through pcalua.exe by the malicious SilentCleanup scheduled task.
SHA256	`9bdf91507fb4f3772a6d66a78f0f1f44075eefba4af65094c374f9d72e25bade`	Hash of 133ngc.bat in the DiskCleanup directory, listed as an intrusion script artifact.
SHA256	`9d667de8a99e757176cea1aa0af0d81972005d4abf3b7aff942d8c30fb151e35`	Hash of mx0342315bc04edd2c.exe, launched through pcalua.exe by the malicious SystemSoundsService scheduled task.
SHA256	`c75048a4933c3061f6cd02c8ca96ed524166fce4cc4b9e0c7ea6ac8295dc3c47`	Hash of qpybfa6a97da7711221.exe, the executable referenced by the malicious Usb-Notifications scheduled task.
SHA256	`ff3706e94d9b769f78e4271928382426cb034b11c5a0f6a8ffea35726cc03692`	Hash of afs1f549b1aa7893d03.exe in the DiskCleanup directory, listed among the intrusion's file indicators.