Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Associated Malware & Tools graphon ... Graphican GoGra remsec_strider BirdyClient Grager graphite
5 distinct techniques documented for this family, organized by ATT&CK tactic.
"GoGra ... uses the Microsoft Graph API to interact with a command-and-control (C&C) server hosted on Microsoft mail services..."; "Grager ... used the Graph API to communicate with a C&C server hosted on Microsoft OneDrive"; "Onedrivetools ... authenticates to Microsoft Graph API and downloads the second stage payload from OneDrive... fetching the new commands to execute from a file called cmd"
An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated malware/tool used by the Harvester/APOPHIS activity, but the content provides no functional description.
Malware using Microsoft Graph API to communicate with a OneDrive-based C2; observed in an attack against an organization in Ukraine.
Previously undocumented malware that connects to the Microsoft Graph API and uses Microsoft OneDrive as command-and-control infrastructure to upload and download files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.