LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0632: GrimAgent

GrimAgent is a backdoor that has been used before the deployment of Ryuk ransomware since at least 2020; it is likely used by FIN6 and Wizard Spider.[1]

EnterpriseS0632MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

GrimAgent matters because ATT&CK describes it as a Windows backdoor observed before Ryuk ransomware deployment. For leaders, the key decision value is not the malware name itself, but whether the organization can recognize backdoor behavior that enables discovery, persistence, command-and-control, tool transfer, data collection, and exfiltration before a ransomware event becomes operationally disruptive.

Executive priority

Treat GrimAgent as a ransomware-predecessor readiness use case. Security leaders should ask whether Windows endpoint, network, and proxy telemetry can show: new persistence through scheduled tasks or Run keys, suspicious command shell activity, host and file discovery, unusual web-based C2, inbound tool transfer, and data leaving over the same channel. This is useful for incident response preparedness, managed detection validation, control prioritization, and audit evidence that the organization can detect and investigate pre-ransomware intrusion activity rather than only final-stage encryption.

Technical view

ATT&CK provides no dedicated detection text for GrimAgent, so defenders should validate coverage through the related behaviors. On Windows, prioritize detections for Scheduled Task creation or modification, Registry Run key and Startup Folder persistence, suspicious cmd.exe execution, file and directory enumeration, system/user/network discovery, local data collection, file deletion, persistence cleanup, ingress tool transfer, and web-protocol C2 using encoding, junk data, or symmetric cryptography. Because the object is associated with obfuscation, binary padding, decoding/deobfuscation, mutex checks, and time-based checks, static hash-only detection and sandbox-only analysis are likely weak control points.

Likely telemetry

  • Windows process creation and command-line logging
  • Windows Scheduled Task creation, modification, and execution events
  • Windows Registry monitoring for Run keys and Startup Folder persistence paths
  • Endpoint file creation, deletion, rename, and directory enumeration activity
  • EDR or host telemetry for mutex creation, API usage, and suspicious process behavior

Detection direction

  • Map existing detections to the related ATT&CK techniques rather than relying on a GrimAgent signature alone.
  • Correlate persistence events with nearby command shell execution, discovery commands, tool transfer, outbound web traffic, and file cleanup activity.
  • Tune web C2 analytics for suspicious encoded content, junk data patterns, unusual destinations, and data exfiltration over the same channel, while accounting for normal enterprise web traffic volume.
  • Review whether file size limits, binary padding, encryption, or obfuscation reduce endpoint scanning and malware-analysis effectiveness.
  • Validate that cleanup behaviors such as file deletion and removal of persistence artifacts are retained in logs long enough for incident reconstruction.

Mitigation priorities

  • Prioritize hardening and monitoring of Windows persistence locations, especially Scheduled Tasks, Registry Run keys, and Startup Folder paths.
  • Restrict and monitor command shell usage where business processes allow, with emphasis on unusual parent-child process chains.
  • Improve outbound network control and logging for web protocols, including proxy visibility and egress review for unmanaged destinations.
  • Ensure endpoint controls can inspect or detonate large, padded, obfuscated, or encoded binaries where feasible.
  • Maintain incident response playbooks for pre-ransomware backdoor activity, including host isolation, credential review, persistence removal, and evidence preservation.
Additional notes and limits

The strongest business relevance is the ATT&CK description that GrimAgent has been used before Ryuk ransomware deployment and is likely used by FIN6 and Wizard Spider. The most actionable defensive content comes from the related techniques: Windows persistence, execution, discovery, C2, tool transfer, local collection, exfiltration, obfuscation, and cleanup. Attribution should remain tentative because the supplied description says likely used, not definitively exclusive to those groups.

MITRE does not provide official detection guidance for this malware object, and the object-level tactics are not specified. The supplied platform is Windows, although several related techniques are cross-platform in ATT&CK. Local telemetry, baselines, malware samples, and incident evidence are required to determine actual exposure or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

GrimAgent

GrimAgent is a backdoor that has been used before the deployment of Ryuk ransomware since at least 2020; it is likely used by FIN6 and Wizard Spider.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

25 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

GrimAgent can set persistence with a Registry run key.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

GrimAgent can use the Windows Command Shell to execute commands, including its own removal.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

GrimAgent has the ability to set persistence using the Task Scheduler.[1]

EnterpriseT1005Data from Local System

GrimAgent can collect data and files from a compromised host.[1]

EnterpriseT1033System Owner/User Discovery

GrimAgent can identify the user id on a target machine.[1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.[1]

EnterpriseT1083File and Directory Discovery

GrimAgent has the ability to enumerate files and directories on a compromised host.[1]

EnterpriseT1105Ingress Tool Transfer

GrimAgent has the ability to download and execute additional payloads.[1]

EnterpriseT1016System Network Configuration Discovery

GrimAgent can enumerate the IP and domain of a target system.[1]

EnterpriseT1132.001Standard EncodingSub-technique

GrimAgent can base64 encode C2 replies.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

GrimAgent can use an AES key to encrypt C2 communications.[1]

EnterpriseT1106Native API

GrimAgent can use Native API including GetProcAddress and ShellExecuteW.[1]

EnterpriseT1480.002Mutual ExclusionSub-technique

GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic `mymutex`.[1]

EnterpriseT1614.001System Language DiscoverySub-technique

GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.[1]

EnterpriseT1614System Location Discovery

GrimAgent can identify the country code on a compromised host.[1]

EnterpriseT1070.009Clear PersistenceSub-technique

GrimAgent can delete previously created tasks on a compromised host.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.[1]

EnterpriseT1001.001Junk DataSub-technique

GrimAgent can pad C2 messages with random generated values.[1]

EnterpriseT1070.004File DeletionSub-technique

GrimAgent can delete old binaries on a compromised host.[1]

EnterpriseT1027Obfuscated Files or Information

GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

GrimAgent has the ability to use HTTP for C2 communications.[1]

EnterpriseT1082System Information Discovery

GrimAgent can collect the OS, and build version on a compromised host.[1]

EnterpriseT1041Exfiltration Over C2 Channel

GrimAgent has sent data related to a compromise host over its C2 channel.[1]

EnterpriseT1027.001Binary PaddingSub-technique

GrimAgent has the ability to add bytes to change the file hash.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0037: FIN6

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.[1][2]

GroupEnterprise

G0102: Wizard Spider

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · GroupG0037: FIN6Enterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · GroupG0102: Wizard SpiderEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1480.002: Mutual ExclusionEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1614: System Location DiscoveryEnterpriseuses · TechniqueT1070.009: Clear PersistenceEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1001.001: Junk DataEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
70bd28a09a4e86d8...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle70bd28a09a4e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  2. [2]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  3. [3]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  4. [4]
    mitre-attackS0632
    Open source URL
  5. [5]
    mitre-attackS0632
    Open source URL
  6. [6]
    mitre-attackS0632
    Open source URL
  7. [7]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  8. [8]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  9. [9]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  10. [10]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  11. [11]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  12. [12]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  13. [13]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  14. [14]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  15. [15]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  16. [16]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  17. [17]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  18. [18]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  19. [19]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  20. [20]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  21. [21]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  22. [22]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  23. [23]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  24. [24]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  25. [25]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  26. [26]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  27. [27]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  28. [28]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  29. [29]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  30. [30]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  31. [31]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  32. [32]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  33. [33]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  34. [34]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  35. [35]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  36. [36]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  37. [37]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  38. [38]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  39. [39]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  40. [40]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  41. [41]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  42. [42]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  43. [43]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  44. [44]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  45. [45]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  46. [46]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  47. [47]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  48. [48]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  49. [49]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  50. [50]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  51. [51]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  52. [52]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  53. [53]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
  54. [54]
    Group IB GrimAgent July 2021

    Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use