To protect against sophisticated malware threats like FINALDRAFT, organizations should regularly monitor Microsoft Graph API usage for any suspicious activity and implement stringent access controls, restricting access to Outlook and the API to only necessary personnel. The use of the Microsoft Graph API for C2 communications shows the critical need for enhanced security measures to protect against such sophisticated threats. Deploying advanced endpoint security solutions can help detect and prevent malware execution, while conducting regular security audits ensures potential vulnerabilities are identified and addressed. The malware obtains a Microsoft Graph API token using a refresh token stored in its configuration. A new family of malware has been discovered that leverages Microsoft Outlook as a communication channel via the Microsoft Graph API. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. It uses the Microsoft Graph API to communicate with its command and control (C2) server. This sophisticated malware includes a custom loader and backdoor, known as PATHLOADER and FINALDRAFT, respectively. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 13 Feb 2025 10:25:21 +0000