FlawedGrace

MITRE ATT&CK: S0383 View on attack.mitre.org

Aliases: GraceWire, FlawedGrace

First seen
2017-10-01 00:00:00
Malware type
rat
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:53:51

Targeted industries: financial-services government-and-public-sector

Targeted regions: country_code:us country_code:gb

Context

FlawedGrace is a fully featured remote access tool (RAT) written in C++ that was first observed in late 2017.

Detection coverage

  • 3 YARA rules

Malware & tools used

  • Encrypted/Encoded File (attack-pattern)

Used by threat actors

  • TA505 (threat-actor)
  • 2023 Increased Truebot Activity (campaign)
  • May 2023 Exfiltration & Wiper Activity (Truebot + FlawedGrace + MBR Killer) (campaign)

Detection rules

  • MALPEDIA_Win_Flawedgrace_Auto (yara-rule)
  • EMBEERESEARCH_Win_Gracewire_Loader_Dec_2022 (yara-rule)
  • SIGNATURE_BASE_MAL_Grace_Dec22 (yara-rule)

Reports & references

  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • telekom.com — Cybersecurity Ta505 S Box Of Chocolate 597672 (report)
  • secureworks.com — Gold Tahoe (report)
  • rewterz.com — Rewterz Threat Alert Widely Abused Msix App Installer Disabled By Microsoft Active Iocs (report)
  • proofpoint.com — Servhelper And Flawedgrace New Malware Introduced Ta505 (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 006 (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 009 (report)
  • blog.intel471.com — A Brief History Of Ta505 (report)
  • intel471.com — A Brief History Of Ta505 (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • Cisco Talos — Breaking The Silence Recent Truebot Activity (report)
  • CrowdStrike — How Falcon Complete Stopped A Solarwinds Serv U Exploit Campaign (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Flawedgrace (report)
  • blog.codsec.com — Gracewire Adventure (report)
  • research.nccgroup.com — Tracking A P2P Network Related With Ta505 (report)
  • twitter.com — 1273359829390655488 (report)
  • web.archive.org — Gracewire Adventure (report)
  • proofpoint.com — Whatta Ta Ta505 Ramps Activity Delivers New Flawedgrace Variant (report)
  • msreverseengineering.com — An Exhaustively Analyzed Idb For Flawedgrace (report)
  • msreverseengineering.com — A Quick Solution To An Ugly Reverse Engineering Problem (report)
  • thedfirreport.com — A Truly Graceful Wipe Out (report)
  • MITRE ATT&CK — S0383 (report)
  • bleepingcomputer.com — New Servhelper Backdoor And Flawedgrace Rat Pushed By Necurs Botnet (report)

External references