RedCurl, a cyber threat group active since 2018 and known for stealthy corporate espionage, has now shifted its approach by deploying ransomware targeting Hyper-V virtual machines.

Initially identified by Group-IB, RedCurl primarily targeted corporate organizations globally, later expanding its reach. However, as reported by Bitdefender Labs, the group has now incorporated ransomware into its operations.

"We've seen RedCurl stick to their usual playbook in most cases, continuing with data exfiltration over longer periods of time," states the Bitdefender report. "However, one case stood out. They broke their routine and deployed ransomware for the first time."

With businesses increasingly adopting virtualized infrastructure, ransomware groups are adapting by designing encryptors for these environments. While most ransomware variants target VMware ESXi servers, RedCurl’s latest tool, QWCrypt, focuses specifically on Hyper-V.

Bitdefender’s analysis reveals that RedCurl initiates attacks through phishing emails containing .IMG attachments disguised as CVs. When opened, these disk image files auto-mount in Windows, executing a malicious screensaver file. This technique exploits DLL sideloading via a legitimate Adobe executable, enabling persistence through scheduled tasks.

To avoid detection, RedCurl employs living-off-the-land (LOTL) techniques, leveraging native Windows utilities. A custom wmiexec variant facilitates lateral movement across networks without triggering security tools, while Chisel provides tunneling and remote desktop access.

Before deploying ransomware, the attackers disable security measures using encrypted 7z archives and a multi-stage PowerShell script.

Unlike standard Windows ransomware, QWCrypt supports multiple command-line arguments, allowing attackers to fine-tune encryption strategies. In observed attacks, RedCurl used the --excludeVM argument to avoid encrypting network gateway virtual machines, ensuring continued access.

The XChaCha20-Poly1305 encryption algorithm is employed to lock files, appending .locked$ or .randombits$ extensions. Additionally, QWCrypt offers intermittent encryption (block skipping) and selective file encryption based on size, optimizing speed.

The ransom note, named "!!!how_to_unlock_randombits_files.txt$", incorporates text fragments from multiple ransomware groups, including LockBit, HardBit, and Mimic.

Unlike most ransomware gangs, RedCurl does not operate a dedicated leak site, raising speculation about its true intentions. Experts propose two theories:

The ransomware may serve as a cover for data theft, creating a distraction while RedCurl exfiltrates sensitive corporate information. It could also act as a backup monetization method when clients fail to pay for stolen data. Another possibility is that RedCurl may conduct covert negotiations with victims, focusing on financial gain without public exposure.

"The RedCurl group's recent deployment of ransomware marks a significant evolution in their tactics," Bitdefender concludes. "This departure from their established modus op