The Brothers Grim

Group-IB provides a technical analysis of GrimAgent, a backdoor used as a prior stage to Ryuk ransomware: the report covers sample metadata (including SHA-256), custom C2 protocol and infrastructure (with Tor links and Ryuk-themed landing pages), execution chain, TTPs mapped to the MITRE ATT&CK matrix, and defensive artifacts (Yara and Suricata rules) to aid detection and attribution.