FlawedAmmyy

Malware Profile Updated 25 days ago
Download STIX
Preview STIX
FlawedAmmyy is a notable malware, specifically a Remote Access Trojan (RAT), that has been leveraged by threat actors for malicious purposes. The malware is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites unbeknownst to the user. Once inside, FlawedAmmyy can steal personal information, disrupt operations, or even hold data hostage for ransom. Notably, it was observed being downloaded as a secondary payload by Get2, another malware, alongside other harmful programs like FlawedGrace, Snatch, and SDBbot. The Cl0p threat actor group has been particularly associated with the use of FlawedAmmyy, using this RAT to communicate with their Command and Control (C2) infrastructure. This enables them to control infected devices remotely and download additional malware components. In addition to FlawedAmmyy, Cl0p is known to utilize other tools such as the Cobalt Strike post-exploitation tool, web shells like DEWMODE and LEMURLOOT, and SDBot. In recent campaigns, the TA505 group has also made significant use of FlawedAmmyy, turning it from a regionally-focused malware into a global threat. They have notably abused Microsoft Excel Web Query files (.iqy attachments) to download FlawedAmmyy onto unsuspecting users' systems. A series of these campaigns were observed in late April and May, with the most recent one occurring on June 7. These incidents underscore the ongoing risk posed by FlawedAmmyy and the need for robust cybersecurity measures to counter it.
What's your take? (Question 1 of 2)
ca5d2a60-571b-4b9c-9f66-0b02381c8f51 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
ClopUnspecified
3
Clop is a malicious software (malware) designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. T
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
cl0pUnspecified
2
Cl0p is a threat actor group that has emerged as the most used ransomware in March 2023, dethroning LockBit. The group has successfully exploited zero-day vulnerabilities in the past, but such attacks are relatively rare. Recent research by Malwarebytes highlights the bias of ransomware gangs for at
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the FlawedAmmyy Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
Ammyy Admin Malware - FlawedAmmy Download | Proofpoint
MITRE
a year ago
TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader | Proofpoint US
MITRE
a year ago
TA505 shifts with the times | Proofpoint US
Flashpoint
a year ago
No title
CERT-EU
a year ago
#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability – Cyber Safe NV
CISA
a year ago
#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability | CISA
Fortinet
10 months ago
Ransomware Roundup - Cl0p | FortiGuard Labs