Earth Kapre
Aliases: RedCurl, Red Wolf, GOLD BLADE
- First seen
- 2018-01-01 00:00:00
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:14:37
Targeted industries: government-and-public-sector energy-and-utilities financial-services technology-and-telecommunications
Context
Earth Kapre is an APT group specializing in cyberespionage. They target organizations in various countries through phishing campaigns using malicious attachments to infect machines. Earth Kapre employs techniques like abusing PowerShell, curl, and Program Compatibility Assistant to execute malicious commands and evade detection within targeted networks. The group has been active since at least 2018 and has been linked to multiple incidents involving data theft and espionage.
Reports & references
- Trend Micro — Unveiling Earth Kapre Aka Redcurls Cyberespionage Tactics With T (report)
- news.sophos.com — Sharpening The Knife Gold Blades Strategic Evolution (report)