Loading story…
A review of a community Microsoft Sentinel analytic for detecting CreepyDrive traffic found that the rule can be readily evaded because it relies on brittle, hardcoded URL and path matches tied to known samples. The detection was built to spot POLONIUM activity using OneDrive and the Microsoft Graph API for command-and-control, but researchers said attackers could bypass it through case changes, URL encoding, renamed folders or files, alternate Graph addressing methods such as item-ID access, and use of the beta API endpoint. The analysis also highlighted incomplete coverage for sovereign cloud Graph domains and dependence on TLS-inspected proxy logs.
Researchers proposed replacing sample-specific string matching with broader coverage of Graph paths and domains, including decoded URLs and case-insensitive matching across standard and alternate addressing patterns. They also recommended layering behavioral analytics to better distinguish malicious SaaS-based C2 from legitimate OneDrive use, including anomalous user agents, regular polling cadence, first-seen Graph activity, and consistent payload-size patterns. The findings underscore that detection for cloud-service abuse is more resilient when it focuses on attacker behavior rather than fixed URL indicators.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
An article published on 2026-07-27 analyzed a community Microsoft Sentinel analytic for detecting POLONIUM-associated CreepyDrive traffic and argued it was easily bypassed through case changes, URL encoding, alternate Microsoft Graph paths, renamed files or folders, beta endpoints, and other gaps. The write-up also proposed broader URL coverage and behavioral analytics to improve detection of OneDrive-based C2.
Microsoft's Azure Sentinel repository published a community analytic rule named "CreepyDrive URLs" to detect Microsoft Graph API URL patterns associated with POLONIUM's CreepyDrive malware using OneDrive for command-and-control. The scheduled high-severity rule targets CommonSecurityLog data from supported network security connectors and is tagged to POLONIUM and ATT&CK techniques T1567.002 and T1102.002.
Microsoft published research detailing POLONIUM activity and infrastructure used to target organizations in Israel. The disclosure publicly documented the threat actor's operations and associated infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedetect.fyi
Open sourcegithub.com
Open sourceattack.mitre.org
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SafePay ransomware operators abused **Microsoft OneDrive** to exfiltrate sensitive victim data, blending theft activity into legitimate cloud-storage use. The group used standard HTTPS connections and ordinary business-cloud workflows, allowing outbound transfers to appear as trusted OneDrive traffic. The technique can evade controls focused on malicious domains, unfamiliar cloud services, or anomalous network protocols, because the data moves through an authorized and widely used platform. Organizations should investigate unusual OneDrive upload volumes, atypical account behavior, and anomalous data-access patterns, and apply monitoring and data-loss-prevention controls to sanctioned cloud services.
Sep 2, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026