Malicious .ISO and .IMG attachments within phishing emails delivered by RedCurl trigger a multi-stage attack that runs an executable to enable curl utility downloading and loader delivery.
Article Link: Windows tool helps RedCurl obscure cyberespionage attacks | SC Media