GraphSteel
GraphSteel is the client component of the Go-based Elephant malware framework and functions as a credential and file stealer. Public reporting cited here states CERT-UA reported GraphSteel and the paired backdoor GrimPlant in March 2022, attributing the activity to UAC-0056, also tracked as TA471, SaintBear, and UNC2589. The framework was delivered via targeted spear-phishing using spoofed Ukrainian governmental email addresses, including lures urging recipients to update systems via a link and macro-enabled XLS attachments themed around wage arrears. In observed chains, payloads were downloaded and saved under names including "microsoft-cortana.exe" for GraphSteel, and some delivery activity involved Discord-hosted payloads and Cobalt Strike Beacon. GraphSteel communicates over WebSockets to a GraphQL endpoint and encrypts messages with AES, using a custom RSA-based key exchange and a hardcoded AES key for pre-exchange traffic. It uses code from goLazagne to steal credentials and searches common user folders for files with extensions including .key, .crt, .json, .csv, .7z, .rar, .zip, .ssh, .ovpn, .pptx, .xlsx, .docx, .ppt, .xls, .doc, and .txt, uploading new files based on MD5 checks. The campaign targeted Ukrainian-related entities and other organizations via spear-phishing. Reported infrastructure tied to the broader Elephant campaign dated back to at least December 2021 and included hosting on providers such as Zservers, PQ Hosting, and Serverion, with French-themed certificate metadata and the domain forkscenter[.]fr. Additional indicators mentioned in the reporting for the broader infection chain include the downloader URL hxxp://194.31.98.124:443/i, the path %HOME%/.java-sdk/java-sdk.exe, and persistence via the Run key Software\Microsoft\Windows\CurrentVersion\Run with value "Java-3DK".
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They named the two components GraphSteel and GrimPlant... Client Component (GraphSteel) The “client” component is a credential and file stealer.
They named the two components GraphSteel and GrimPlant... Client Component (GraphSteel) The “client” component is a credential and file stealer.
IOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Go-based credential and file stealer component of Elephant. Steals credentials using goLazagne-derived code and searches common user folders for sensitive file types (e.g., .key, .crt, .ssh, .ovpn, Office docs, archives) for exfiltration. Communicates to a GraphQL endpoint over WebSockets; messages encrypted with AES; receives session key via a custom RSA-based exchange.
Who is behind the Cyberattacks on Ukraine's Critical Information Infrastructure... GraphSteel GrimPlant ...
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.