Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Associated Malware & Tools graphon ... Graphican GoGra remsec_strider BirdyClient Grager graphite
5 distinct techniques documented for this family, organized by ATT&CK tactic.
"GoGra ... uses the Microsoft Graph API to interact with a command-and-control (C&C) server hosted on Microsoft mail services..."; "Grager ... used the Graph API to communicate with a C&C server hosted on Microsoft OneDrive"; "Onedrivetools ... authenticates to Microsoft Graph API and downloads the second stage payload from OneDrive... fetching the new commands to execute from a file called cmd"
Its file name—vxdiff.dll—was the same as a legitimate DLL associated with an application called Apoint (apoint.exe) ... Whether the malware was simply masquerading as a legitimate file or whether it was being sideloaded by Apoint remains unknown.
An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services.
Analysis of the BirdyClient malware (Trojan.BirdyClient) revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it.
BirdyClient ... use[s] Microsoft OneDrive as a C&C server mechanism to upload and download files from it.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.