CURIUM
CURIUM is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 21 countries, including the United States and the United Kingdom. It uses 52 MITRE ATT&CK techniques.
- Crimson Sandstorm
- TA456
- Tortoise Shell
- Yellow Liderc
- Imperial Kitten
- Origin
- Iran
- Techniques
- 52
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Last seen
- Oct 25, 2023
- Record updated
Who They Target.
About CURIUM.
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. CURIUM has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware.
Last updated Jul 24, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.