FlawedAmmyy

FlawedAmmyy is a notable malware, specifically a Remote Access Trojan (RAT), that has been leveraged by threat actors for malicious purposes. The malware is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites unbeknownst to the user. Once inside, FlawedAmmyy can steal personal information, disrupt operations, or even hold data hostage for ransom. Notably, it was observed being downloaded as a secondary payload by Get2, another malware, alongside other harmful programs like FlawedGrace, Snatch, and SDBbot. The Cl0p threat actor group has been particularly associated with the use of FlawedAmmyy, using this RAT to communicate with their Command and Control (C2) infrastructure. This enables them to control infected devices remotely and download additional malware components. In addition to FlawedAmmyy, Cl0p is known to utilize other tools such as the Cobalt Strike post-exploitation tool, web shells like DEWMODE and LEMURLOOT, and SDBot. In recent campaigns, the TA505 group has also made significant use of FlawedAmmyy, turning it from a regionally-focused malware into a global threat. They have notably abused Microsoft Excel Web Query files (.iqy attachments) to download FlawedAmmyy onto unsuspecting users' systems. A series of these campaigns were observed in late April and May, with the most recent one occurring on June 7. These incidents underscore the ongoing risk posed by FlawedAmmyy and the need for robust cybersecurity measures to counter it.