A developing variant of “FlawedGrace”, a remote access trojan (RAT) first observed in late 2017, has been identified by Proofpoint researchers to be involved in the massive email attack conducted by TA505 and has been occurring throughout October of 2021. The email attack, dubbed “MirrorBlast”, is targeting various industries with one specific operation focusing on Germany and Austria. FlawedGrace was designed to prevent reverse-engineering and analysis while also establishing communications with command-and-control (C2) servers and exfiltrating specified data. The Proofpoint researchers noted that the variant utilized by TA505 includes the following changes: encrypted strings, obfuscated API calls, and the technique of configuration being stored as an encrypted resource to then be stored in a mapped memory region as well as the registry (which allows persistence). Researchers identified the FlawedGrace variant in the “MirrorBlast” phishing campaign, which was discussed overall in last week’s FLASH issue, as the last step in the attack path. The RAT is dropped by one of the final loaders downloaded during the attack. To review Proofpoint’s in-depth research on the massive email attack overall as well as gain indicators of compromise (IOCs), please refer the report linked below.