MALWARE FAMILY

FlawedGrace

Internal ID: win.flawedgrace

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT). It seems to have been developed in the second half of 2017 mainly.

FlawedGrace uses a series of commands:

FlawedGrace also uses a series of commands, provided below for reference:

* desktop_stat

* destroy_os

* target_download

* target_module_load

* target_module_load_external

* target_module_unload

* target_passwords

* target_rdp

* target_reboot

* target_remove

* target_script

* target_servers

* target_update

* target_upload

Threat Analysis

FlawedGrace is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.codsec.com/posts/malware/gracewire_adventure/

→https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/

→https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/

→https://intel471.com/blog/a-brief-history-of-ta505

→https://research.nccgroup.com/2021/12/01/tracking-a-p2p-network-related-with-ta505/

→https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

→https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf

→https://twitter.com/MsftSecIntel/status/1273359829390655488

→https://web.archive.org/web/20221115161556/https://blog.codsec.com/posts/malware/gracewire_adventure/

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.flawedgrace

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search FlawedGrace