GRIMBOLT
- Malware type
- backdoor, rat
- Last IoC activity
- 2026-06-08 12:56:24
- Profile updated
- 2026-07-07 13:17:44
Targeted industries: government-and-public-sector technology-and-telecommunications defense-and-aerospace
Context
According to Mandiant, GRIMBOLT is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with UPX. It provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload. It's unclear if the threat actor's replacement of BRICKSTORM with GRIMBOLT was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response.
Reports & references
- cloud.google.com — Unc6201 Exploiting Dell Recoverpoint Zero Day (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Grimbolt (report)