GrimPlant
GrimPlant is a Go-based backdoor component of the Elephant malware framework. Public reporting cited here states Elephant was delivered via targeted spear-phishing using spoofed Ukrainian government email addresses and was attributed by CERT-UA to UAC-0056, also tracked as TA471, SaintBear, and UNC2589. CERT-UA reported GrimPlant together with the GraphSteel stealer in March 2022.
Within the Elephant framework, GrimPlant is the implant/backdoor component, while other components include a dropper, a downloader, and the GraphSteel credential/file stealer. GrimPlant allows operators to execute arbitrary PowerShell scripts on an infected Windows machine. In observed delivery chains, phishing lures included links impersonating Ukrainian state bodies and macro-enabled XLS attachments themed around wage arrears. One chain downloaded additional payloads from Discord and saved them as "oracle-java.exe" (GrimPlant) and "microsoft-cortana.exe" (GraphSteel). Another chain used an XLS attachment that created "Base-Update.exe" to download and execute GraphSteel and GrimPlant.
Technically, GrimPlant receives its C2 address via a "-addr" command-line flag, with the address AES-CBC encrypted using a null IV and an embedded key. It hardcodes C2 port 80 and communicates over gRPC with TLS. It embeds a root certificate to validate the C2 server certificate and support certificate rotation without redeploying the malware. GrimPlant authenticates to the C2 server using the password "sdrunlygvhwbcaeiuklgunvre," sends heartbeats every 10 seconds, and polls for commands every 3 seconds.
Related campaign details in the same reporting include Elephant downloader persistence via the Windows Run key Software\Microsoft\Windows\CurrentVersion\Run using the value name "Java-3DK," downloader retrieval from hxxp://194.31.98.124:443/i saved as %HOME%/.java-sdk/java-sdk.exe, and anti-emulation behavior such as sleeping and allocating 200 MB of garbage data. Infrastructure analysis tied the broader Elephant activity to servers observed since at least December 2021, including hosting at Zservers, PQ Hosting, and Serverion, with French-themed certificate metadata and the domain forkscenter[.]fr. Additional campaign indicators mentioned include spoofed sender domain mdfi.gov.ua, sender IP 87.249.139.161, phishing subject "Заборгованість по зарплаті," and dropped filenames "oracle-java.exe," "microsoft-cortana.exe," and "Base-Update.exe."
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“oracle-java.exe” (GrimPlant backdoor)... Implant Component (GrimPlant) GrimPlant is a backdoor that allows the operator to execute arbitrary PowerShell scripts on the infected machine.
“oracle-java.exe” (GrimPlant backdoor)... Implant Component (GrimPlant) GrimPlant is a backdoor that allows the operator to execute arbitrary PowerShell scripts on the infected machine.
IOCs tracked for this family
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Go-based backdoor/implant component of Elephant enabling remote command execution via PowerShell. Uses gRPC over TLS with an embedded root CA for server verification and certificate rotation; C2 address provided via encrypted command-line argument; periodic heartbeat and command polling; includes anti-emulation (sleep + 200MB allocation).
Who is behind the Cyberattacks on Ukraine's Critical Information Infrastructure... GraphSteel GrimPlant ...
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.