Gracewire

Gracewire is a potent malware that has been deployed by threat actors to exploit and damage computer systems. It is typically delivered through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside a system, it can steal personal information, disrupt operations, and even hold data hostage for ransom. Two groups known as Sangria Tempest (also referred to as FIN7 or Carbon Spider) and Lace Tempest have been associated with the use of Gracewire in their cyber intrusions. Sangria Tempest has been exploiting application installers to infect endpoints with Carbanak, a backdoor and loader used by the group since 2014. This in turn installs the Gracewire spyware, capable of stealing passwords, banking information, and other sensitive data. The group has also utilized Google ads to lure users into downloading malicious MSIX packages, leading to the delivery of POWERTRASH, which subsequently loads NetSupport and Gracewire. Furthermore, Sangria Tempest has cooperated with Lace Tempest in past intrusions, indicating a level of coordination between these threat actors. Lace Tempest, on the other hand, exploited a vulnerability in the SysAid software to deliver a malware loader for Gracewire. After exploiting this vulnerability, the group issued commands via the SysAid software to deliver the malware loader. This activity is typically followed by human-operated actions such as lateral movement within the compromised network, data theft, and ransomware deployment. The continued activities of these groups underline the persistent threat posed by Gracewire and the importance of robust cybersecurity measures.