Earth Kapre, also known as RedCurl and Red Wolf, emerged in 2018 as a Russian-speaking cyber espionage group with a primary motivation of corporate espionage and data theft. The group is assessed with moderate confidence to be of Russian origin, focusing on stealing confidential commercial and employee information. Initially, their operations centered on covert data exfiltration with long dwell times of two to six months within compromised networks to avoid detection. A distinguishing characteristic is their meticulous crafting of spear-phishing emails, often HR-themed and customized with company-specific details, to increase their legitimacy and effectiveness. In a significant evolution of their tactics, Earth Kapre began deploying the QWCrypt ransomware in March 2025, marking a shift to include financial extortion by targeting hypervisors to disable virtualized infrastructure.

Aliases del actor

GOLD BLADERed WolfRedCurlearthkapregoldbladeredcurlredloaderredwolf

Actores similares

earthkapreactor · 1RedCurlactor · 1redcurlactor · 1earth-kapreactor · 1direwolfransomware · 18redalertransomware · 2redransomwareransomware · 2Scattered Spideractor · 2redactactor · 2Scattered Lapsus$ Huntersthreat-actor · 1