Threat Actor RedCurl Develops Ransomware to Encrypt Hyper-V Servers

RedCurl, an espionage-focused threat actor active since 2018, has been observed deploying a new ransomware family called QWCrypt that targets Microsoft Hyper-V VMs; researchers detail a phishing-led chain using .IMG CV attachments, DLL sideloading, scheduled tasks for persistence, bespoke lateral movement tools, and tunneling via Chisel, and note QWCrypt's XChaCha20-Poly1305 encryption, selective encryption options, and operational tradecraft suggesting stealthy, possibly state-linked motives.