Loading malware…
FlawedGrace, also known as GraceWire, is a Windows remote access trojan and backdoor written in C++ that has been active since at least 2017. It is a full-featured post-compromise implant associated most closely with the financially motivated TA505 cluster and has also appeared in operations linked to Evil Corp and in intrusion chains involving TrueBot. FlawedGrace has been used as a second-stage payload following loaders and downloaders such as ServHelper, Get2, MirrorBlast, KiXtart- and REBOL-based intermediaries, and TrueBot, and it has also been observed in intrusions that later culminated in enterprise ransomware deployment, including Clop-related activity.
The malware provides hands-on remote control of infected systems and supports standard RAT functionality including command execution, file transfer, script execution, and remote desktop-related capabilities. Public reporting also describes password-stealing functionality, process injection into legitimate Windows processes, encrypted payload storage, and persistence mechanisms including scheduled-task abuse and registry-based storage. In some observed activity, operators abused a legitimate backup-related scheduled task and its COM handler to load FlawedGrace for persistence. Government reporting has additionally described registry modification, use of print-spooler-related components for persistence or privilege escalation, and injection into system processes to establish command-and-control connectivity.
FlawedGrace uses an encrypted custom binary command-and-control protocol, commonly over TCP port 443, and stores configuration data in encrypted form. Reverse-engineering reporting has characterized its networking stack as sophisticated and noted use of a custom virtual filesystem for configuration management and command-and-control operations. Later variants introduced stronger obfuscation, including encrypted strings, obfuscated API resolution, and encrypted configuration storage in resources, memory, and the registry.
Distribution has most often been tied to phishing-driven intrusion chains. TA505 campaigns delivered precursor malware through malicious Office documents, macro-enabled Excel attachments, HTML redirectors, landing pages impersonating file-sharing services, and related social-engineering lures. Those initial stages then retrieved intermediate loaders or downloaders that ultimately deployed FlawedGrace. It has also been observed after exploitation-based access, including activity involving Netwrix Auditor and SolarWinds Serv-U compromises, as well as in campaigns where Raspberry Robin or TrueBot served as upstream delivery mechanisms.
FlawedGrace has been used against a broad range of sectors rather than a single niche. Reported targeting associated with its operators includes financial institutions, retail, restaurants, healthcare, education, government, and other enterprise environments across multiple regions. Its role in these operations is typically as a durable foothold and operator-controlled backdoor that enables deeper compromise, follow-on tooling, credential theft, lateral movement, and preparation for monetization through ransomware or other financially motivated objectives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
...abusing the COM handler associated with it to execute malicious code, leading to FlawedGrace RAT.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
Researchers thought EvilCorp to be linked to TrueBot due to TrueBot dropping FlawedGrace. FlawedGrace is malware that is attributed to EvilCorp.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Cyber threat actors have historically used malicious phishing emails as the primary delivery method of Truebot malware... users will be redirected to a malicious web domain where script files are then executed.
TA505 semble avoir procédé à la distribution de ses charges malveillantes uniquement par campagnes de courriels d’hameçonnage... L’unique vecteur d’infection pour l’instant connu du mode opératoire TA505 demeure le courriel d’hameçonnage incluant une pièce jointe ou un lien malveillant.
Ces pièces jointes pouvaient notamment être des archives zip ou 7zip contenant des scripts VBS ou Javascript à faire exécuter par ses victimes, des pages HTML contenant du Javascript malveillant, ou des documents Office piégés via macros malveillantes.
L’unique vecteur d’infection pour l’instant connu du mode opératoire TA505 demeure le courriel d’hameçonnage incluant une pièce jointe ou un lien malveillant... ce dernier envoyait directement des liens vers ses pages d’hameçonnage dans ses courriels malveillants.
FlawedGrace is a remote access tool (RAT) that can receive incoming commands [T1059] from a C2 server...
La victime est alors incitée à télécharger, ouvrir et activer les macros VBA d’un document Office, généralement Excel, contenant une charge malveillante.
The macro evaluates JScript via the ScriptControl ActiveX AddCode method.
Ce mode opératoire s’appuie exclusivement durant cette période sur de l’ingénierie sociale pour faire exécuter ses charges contenues dans des pièces jointes malveillantes... La victime est alors incitée à télécharger, ouvrir et activer les macros VBA d’un document Office. | Le but de ces documents était souvent d’exécuter via des macros des commandes msiexec sur la machine de la victime pour télécharger et exécuter un code malveillant.
Configuration is now stored as an encrypted resource (initial/default config), then it is stored both in a mapped memory region (current configuration instance) and in the registry (persistence)
The tool can create scheduled tasks and inject payloads into msiexec[.]exe and svchost[.]exe ... as well as load dynamic link libraries (DLLs) [T1055.001] to accomplish privilege escalation.
TA505 utilise un code de compression... appelé Minedoor... pour rendre ces codes malveillants plus difficiles à analyser.
TA505 uses a compression code... called Minedoor... used to compress both early stage malwares such as FlawedGrace, and final codes deployed by TA505 such as Clop or DeactivateDefender.
During FlawedGrace’s execution phase, the RAT stores encrypted payloads [T1027.009] within the registry.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
The tool can create scheduled tasks and inject payloads into msiexec[.]exe and svchost[.]exe ... as well as load dynamic link libraries (DLLs) [T1055.001] to accomplish privilege escalation.
msiexec.exe silently downloads and installs the MSI (UILevel=-2), not as a child of Excel, to break chain visibility.
FlawedAmmyy / FlawedGrace remote access trojan (RAT) collects information and attempts to communicate with the Command and Control (C2) server to enable the download of additional malware components [T1071], [T1105].
Loaders send base64-encoded HTTP GET beacons (domain, user, OS, arch, process list) to the C2 and poll for tasking.
56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A full-featured remote access trojan used as the final payload in the MirrorBlast chain, providing operators with interactive control of compromised systems.
FlawedGrace is described as the likely next-stage remote access trojan payload associated with TA505.
A malware payload dropped by TrueBot and discussed as part of attribution analysis linking activity to EvilCorp.
Only mentioned incidentally in a reference title, not discussed in the body content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.