GRIMBOLTMalware
According to Mandiant, GRIMBOLT is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with UPX. It provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload.From MISP Galaxy
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”
- T1505.003Web Shell
“Volexity found evidence of web shells, cryptocurrency miners, and alternate VPN configurations.”
- T1552.004Private Keys
“…t 341 malicious “skills” published to ClawHub and GitHub that deliver info-stealing malware targeting cryptocurrency API keys, wallet private keys, SSH credentials and browser passwords.”
- T1556.009Conditional Access Policies
“Volexity assesses with high confidence that this was done to blend in with legitimate network traffic and evade Conditional Access policies that would have otherwise prevented access.”
- T1657Financial Theft
“…ack spoofed Ukrainian judicial domains to target a senior legal advisor, aiming to gain remote access for intelligence gathering or financial theft.”
- T1684Social Engineering
“The infostealer, linked to the GrayBravo threat actor, is spreading through social engineering lures such as fake CAPTCHAs.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-03 - February 2026“…eral movement, persistent access, and the deployment of malware including SLAYSTYLE, BRICKSTORM, as well as a novel backdoor tracked as GRIMBOLT.”
-
VerdantBamboo: Just Another BRICKSTORM in the Firewall“This malware was referred to as “GRIMBOLT” by Google Cloud.”
Indicators in its reports
named in the reports above- 98ee964edeb5a988c3bba8ea1e57fe0ein 1 report
- e952c18272efa1c3…f443c02743fein 1 report
- ee41e06ed96182ce…842d39b99b0ain 1 report
- 58d4eccc982c9e9b1b98aa62c514e53ain 1 report
- f4d77958a12a0778…b18f82e332c4in 1 report
- 40d264cf9c739239…ca46e6067bf5in 1 report
- 84ad78b2bab946c3677fdc28ebd8a774in 1 report
- 681075027553546c…f84633dcffcein 1 report
- f70abe93112637d3…fc17a8f8a264in 1 report
- 95dc2289427ed29b8b996d0e3d1b78cbin 1 report
- f8d93c1769e877aa…67b5ae371c7ain 1 report
- eb141a4395880272…c0a1be326e2ein 1 report
- host[.]servicesin 1 report
- e28a96f983b8605d…0e5ad7d6cec0in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.