Loading malware…
FlowCloud is a modular Windows remote access trojan used in targeted cyberespionage operations. Publicly identified in June 2020, it is associated with TA410, including its FlowingFrog subgroup, and with activity tracked as TALONITE. It has targeted U.S. utility providers, particularly the electric sector. OVERCAST PANDA also deployed FlowCloud against director- and executive-level employees at a U.K. legal firm in September and October 2025.
FlowCloud provides remote command execution, filesystem access, process and service management, system information collection, screenshots, keylogging, credential capture, clipboard access, and data exfiltration. Its modular architecture supports plugins and additional components. Port forwarding and Nmap-assisted scanning support lateral movement. Collected information can be staged in local SQLite databases before transmission to attacker-controlled infrastructure. Analyzed variants use Protocol Buffers for configuration and command-and-control messages, encrypted configuration storage, and a custom encrypted binary communications protocol.
Delivery has included spearphishing emails carrying executable attachments or macro-enabled Microsoft Word documents, often using engineering, energy training, and professional certification themes. FlowCloud has also been delivered through Royal Road documents exploiting Microsoft Office Equation Editor vulnerabilities. Its multistage installation chains abuse legitimate applications and utilities, DLL sideloading, and shellcode injection. Persistence mechanisms, anti-analysis features, and rootkit components help maintain access and conceal activity.
Analyzed versions include C-based and C++-based implementations with architectural differences. Observed operations emphasize enterprise access, surveillance, and information gathering; targeting of electric utilities does not establish that FlowCloud has penetrated industrial control networks or performed disruptive control-system operations.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“In September and October 2025, OVERCAST PANDA targeted executive-level employees at a U.K.-based legal firm, deploying FlowCloud malware on hosts assigned to director- and executive-level employees.”
FlowCloud is a RAT reported by Proofpoint in June 2020. FlowCloud has been reported to be v4 and v5, but the FlowCloud we observed at this time was similar to v4.
The lures focus on engineering-specific themes and concepts, and distributed malware known as FlowCloud and LookBack.
Proofpoint researchers identified a new, additional malware family named FlowCloud that was also being delivered to U.S. utilities providers. FlowCloud malware, like LookBack, gives attackers complete control over a compromised system.
Proofpoint researchers identified a new, additional malware family named FlowCloud that was also being delivered to U.S. utilities providers. FlowCloud malware, like LookBack, gives attackers complete control over a compromised system.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
The group uses phishing techniques with either malicious documents or executables.
TALONITE gains initial enterprise network access via spearphishing activity that leverages malicious documents and executables.
10 – cmd.exe command shell 4097 – write command to shell
after an extended period of using PE attachments to deliver FlowCloud in campaigns, the threat actors behind FlowCloud switched to using Microsoft Word documents with malicious macros... FlowCloud uses this same method exactly including identical macro concatenation code.
TALONITE TTPs from MITRE ATT&CK ... EXECUTION ... T1106 Native API
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
The earlier LookBack versions of the macro included the payload in numerous privacy enhanced email (“.pem”) files that were dropped when the attachment file is executed by the user.
7 – service related 0 - get service list 1 - start service 2 - stop service 3 - delete service 4 - set service start type
rule apt_Windows_TA410_FlowCloud_dll_hijacking_strings { meta: description = "Matches filenames inside TA410 FlowCloud malicious DLL." ... $dll1 = "emedres.dll" ... $dll2 = "vviewres.dll" ... $dll3 = "setlangloc.dll" }
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
EhStorAuthn.exe extracts the subsequent payload file components and installs them to the directory C:\Windows\Media\SystemPCAXD\ado\fc. This file also sets registry key values that store the keylogger drivers and the malware configuration as the value “KEY_LOCAL_MACHINE\SYSTEM\Setup\PrintResponsor\<2-4>”.
Responsor.dat unpacks several modules (rescure86.dat or rescure64.dat) to the registry %TEMP%\{0d47c9bc-7b04-4d81-9ad8-b2e00681de8e}" and installs the unpacked file as a service named “FSFilter Activity Monitor” or “FltMgr”.
Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.
Tendyron / FlowCloud ... Backdoor based on Farfli/Gh0st running in iexplorer.exe ... Tendyron downloader running in iexplorer.exe ... injects
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
Responsor.dat unpacks several modules (rescure86.dat or rescure64.dat) to the registry %TEMP%\{0d47c9bc-7b04-4d81-9ad8-b2e00681de8e}" and installs the unpacked file as a service named “FSFilter Activity Monitor” or “FltMgr”.
Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.
FlowCloud Capabilities • Detection Evasion • ≥ 65 dB Rootkit
The malware incorporates multiple components including legitimate items such as certutil.exe from Microsoft that the malware abuses, or malware components items masquerading as legitimate utilities such as the malicious proxy tool GUP.exe, named after a legitimate Notepad++ executable.
Tendyron / FlowCloud ... Backdoor based on Farfli/Gh0st running in iexplorer.exe ... Tendyron downloader running in iexplorer.exe ... injects
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
rule apt_Windows_TA410_LookBack_decryption { meta: description = "Matches encryption/decryption function used by LookBack." ... } ; rule apt_Windows_TA410_FlowCloud_header_decryption { meta: description = "Matches the function used to decrypt resources headers in TA410 FlowCloud" ... } ; rule apt_Windows_TA410_FlowCloud_shellcode_decryption { meta: description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL" ... }
This file is next saved as a portable executable file named “gup.exe” and executed using a version of the certutil.exe tool named “Temptcm.tmp”.
rule apt_Windows_TA410_FlowCloud_malicious_dll_antianalysis { meta: description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL." ... }
rule apt_Windows_TA410_FlowCloud_dll_hijacking_strings { meta: description = "Matches filenames inside TA410 FlowCloud malicious DLL." ... $dll1 = "emedres.dll" ... $dll2 = "vviewres.dll" ... $dll3 = "setlangloc.dll" }
EhStorAuthn.exe extracts the subsequent payload file components and installs them to the directory C:\Windows\Media\SystemPCAXD\ado\fc. This file also sets registry key values that store the keylogger drivers and the malware configuration as the value “KEY_LOCAL_MACHINE\SYSTEM\Setup\PrintResponsor\<2-4>”.
rule apt_Windows_TA410_Rootkit_strings ... $driver2 = "\\Driver\\mouclass" ... $device2 = "\\Device\\PointerClass0"
FlowCloud has typical RAT functionality such as access to the filesystem, processes, and services, screenshots, keylogging, command shell...
7 – service related 0 - get service list 1 - start service 2 - stop service 3 - delete service 4 - set service start type
TALONITE TTPs from MITRE ATT&CK ... DISCOVERY ... T1046 Network Scanning Service
6 – process related 0 - get process list 1 - kill process
LookBack Capabilities • System Information ... FlowCloud Capabilities • System Information
Command 2 – filesystem related Subcommand 0 - get drive information 1 - get directory listing ... 10 - search directory for files with a given file name pattern
rule apt_Windows_TA410_FlowCloud_malicious_dll_antianalysis { meta: description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL." ... }
9 – system related 0 - get installed software
It also includes port mapping and Nmap port scanning to help facilitate lateral movement.
TALONITE TTPs from MITRE ATT&CK ... COLLECTION ... T1005 Data from Local System
rule apt_Windows_TA410_Rootkit_strings ... $driver2 = "\\Driver\\mouclass" ... $device2 = "\\Device\\PointerClass0"
FlowCloud has typical RAT functionality such as access to the filesystem, processes, and services, screenshots, keylogging, command shell...
TALONITE TTPs from MITRE ATT&CK ... COLLECTION ... T1113 Screen Capture
“clipboard” - possibly steal clipboard contents The config and code hint at this functionality, but it is not implemented in the analyzed sample
“audio” - possibly audio recording The config and code hint at this functionality, but it is not implemented in the analyzed sample
C&C uses a binary protocol over TCP to “exchange_server:exchange_server_port” from the config.
rule apt_Windows_TA410_LookBack_HTTP ... $s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1..." ... rule apt_Windows_TA410_FlowCloud_fcClientDll_strings ... $s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
11 – lateral movement related 4097 - setup port mapping using https://github.com/windworst/LCX
The lures (Figure 2) focus on engineering-specific themes and concepts, and distributed malware known as FlowCloud and LookBack.
Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.
Periodically a separate execution thread will go through the SQLite databases created by the exfiltration managers and send the data to the C&C server.
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.