RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage

The report describes RedCurl (Earth Kapre) conducting multi-stage phishing campaigns that deliver malicious ISO/IMG attachments to fetch legitimate curl, load malicious DLLs (ms.dll/ps.dll), and abuse the Windows Program Compatibility Assistant (pcalua.exe), PowerShell, and Impacket to spawn downloaders and connect to C2 infrastructure; the report also notes Turla’s use of a Pelmeni wrapper for DLL side-loading to deploy the Kazuar backdoor.