Loading malware…
FlowCloud is a modular Windows remote access trojan associated primarily with TA410 and the ICS-focused activity cluster TALONITE. It has been used in espionage-oriented campaigns targeting U.S. utility providers and the broader electric sector, with additional reporting linking related activity to victims in Japan and Taiwan. FlowCloud has been observed in multiple versions, including 4.x and 5.x branches, and appears to have a multi-component architecture with plugin-style extensibility.
FlowCloud provides broad post-compromise control over infected systems. Reported capabilities include collection of system and host information, access to files, processes and services, command shell execution, screenshot capture, keylogging support, and structured data exfiltration. Some variants also support port mapping and Nmap-assisted network scanning to facilitate internal reconnaissance and potential lateral movement. Code artifacts and configuration fields indicate additional support in some builds for clipboard theft, audio capture, and targeted file collection. Reporting also describes rootkit-related components and anti-analysis or detection-evasion functionality in the TA410 toolset around FlowCloud.
The malware uses encrypted configuration data and a custom encrypted binary command-and-control protocol. Version 4.1.3 has been documented as using Protocol Buffers extensively for both configuration and C2 messaging, RC4-protected payload exchanges, local SQLite-backed staging for collected data, and separate exfiltration managers for files, screenshots, keylogging output, plugins, and other data types. FlowCloud has also been observed downloading supporting components such as packet capture and scanning dependencies from attacker-controlled infrastructure.
Delivery has been tied to spearphishing campaigns using engineering, training, certification, and utility-themed lures. Observed infection chains include malicious PE attachments and macro-enabled Microsoft Word documents, as well as Royal Road-generated RTF lures exploiting Microsoft Office Equation Editor vulnerabilities. TA410-linked tradecraft has also included abuse of legitimate binaries, certutil-assisted staging, DLL hijacking, and execution through renamed or modified legitimate software to establish persistence and blend with normal activity.
Within industrial-sector targeting, FlowCloud has been used for initial access support, persistence, credential capture, and information gathering rather than confirmed disruptive control-system effects. Available reporting does not show verified disruptive ICS operations or confirmed penetration of control-system networks by TALONITE using FlowCloud. The malware is best characterized as a mature espionage RAT used in long-running campaigns against energy-sector and other strategic targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FlowCloud is a RAT reported by Proofpoint in June 2020. FlowCloud has been reported to be v4 and v5, but the FlowCloud we observed at this time was similar to v4.
The lures focus on engineering-specific themes and concepts, and distributed malware known as FlowCloud and LookBack.
Proofpoint researchers identified a new, additional malware family named FlowCloud that was also being delivered to U.S. utilities providers. FlowCloud malware, like LookBack, gives attackers complete control over a compromised system.
Proofpoint researchers identified a new, additional malware family named FlowCloud that was also being delivered to U.S. utilities providers. FlowCloud malware, like LookBack, gives attackers complete control over a compromised system.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
The earlier LookBack versions of the macro included the payload in numerous privacy enhanced email (“.pem”) files that were dropped when the attachment file is executed by the user.
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
EhStorAuthn.exe extracts the subsequent payload file components and installs them to the directory C:\Windows\Media\SystemPCAXD\ado\fc. This file also sets registry key values that store the keylogger drivers and the malware configuration as the value “KEY_LOCAL_MACHINE\SYSTEM\Setup\PrintResponsor\<2-4>”.
Tendyron / FlowCloud ... Backdoor based on Farfli/Gh0st running in iexplorer.exe ... Tendyron downloader running in iexplorer.exe ... injects
The malware incorporates multiple components including legitimate items such as certutil.exe from Microsoft that the malware abuses, or malware components items masquerading as legitimate utilities such as the malicious proxy tool GUP.exe, named after a legitimate Notepad++ executable.
Tendyron / FlowCloud ... Backdoor based on Farfli/Gh0st running in iexplorer.exe ... Tendyron downloader running in iexplorer.exe ... injects
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
rule apt_Windows_TA410_LookBack_decryption { meta: description = "Matches encryption/decryption function used by LookBack." ... } ; rule apt_Windows_TA410_FlowCloud_header_decryption { meta: description = "Matches the function used to decrypt resources headers in TA410 FlowCloud" ... } ; rule apt_Windows_TA410_FlowCloud_shellcode_decryption { meta: description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL" ... }
EhStorAuthn.exe extracts the subsequent payload file components and installs them to the directory C:\Windows\Media\SystemPCAXD\ado\fc. This file also sets registry key values that store the keylogger drivers and the malware configuration as the value “KEY_LOCAL_MACHINE\SYSTEM\Setup\PrintResponsor\<2-4>”.
7 – service related 0 - get service list 1 - start service 2 - stop service 3 - delete service 4 - set service start type
TALONITE TTPs from MITRE ATT&CK ... DISCOVERY ... T1046 Network Scanning Service
LookBack Capabilities • System Information ... FlowCloud Capabilities • System Information
Command 2 – filesystem related Subcommand 0 - get drive information 1 - get directory listing ... 10 - search directory for files with a given file name pattern
TALONITE TTPs from MITRE ATT&CK ... COLLECTION ... T1005 Data from Local System
rule apt_Windows_TA410_Rootkit_strings ... $driver2 = "\\Driver\\mouclass" ... $device2 = "\\Device\\PointerClass0"
FlowCloud has typical RAT functionality such as access to the filesystem, processes, and services, screenshots, keylogging, command shell...
C&C uses a binary protocol over TCP to “exchange_server:exchange_server_port” from the config.
rule apt_Windows_TA410_LookBack_HTTP ... $s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1..." ... rule apt_Windows_TA410_FlowCloud_fcClientDll_strings ... $s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
11 – lateral movement related 4097 - setup port mapping using https://github.com/windworst/LCX
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom remote access trojan used by TALONITE in spearphishing campaigns against the electric sector. It facilitates credential capture and persistence, performing minor system operations before launching a renamed copy of Microsoft's HTML Help Workshop (hhw.exe) and storing host data in database files under the renamed utility's subdirectory.
A RAT used by TA410; the observed sample was similar to FlowCloud v4.
Remote access trojan used by TA410 that provides filesystem, process, and service access; screenshots; keylogging support; command shell; plugin-based extensibility; port mapping; Nmap-assisted lateral movement; and multiple data-exfiltration managers for files, directories, screenshots, and potentially audio, clipboard, and pattern-based file theft.
FlowCloud is a multi-stage C++ remote access trojan with modular components, keylogging capability, file and process access, screen/keyboard/mouse monitoring, service management, and data exfiltration over a custom binary C2 protocol. It uses legitimate and imitation QQ components during execution and stores encrypted configuration data in the registry.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.