Hackers Exploit Microsoft Graph API For C&C Communications

An emerging threat leverages Microsoft’s Graph API to facilitate command-and-control (C&C) communications through Microsoft cloud services. 

Recently, security analysts at Symantec discovered a previously undocumented malware called BirdyClient or OneDriveBirdyClient.

This malware targeted an organization in Ukraine. It abused Microsoft OneDrive for C&C by connecting to the Graph API to upload and download files. 

While masquerading as legitimate software, the malware’s core functionality reveals an evolving technique that leverages trusted cloud services for malicious purposes by threat actors of unknown motivation and attribution.

Integrate ANY.RUN in Your Company for Effective Malware Analysis

Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

• Real-time Detection
• Interactive Malware Analysis
• Easy to Learn by New Security Team members
• Get detailed reports with maximum data
• Set Up Virtual Machine in Linux & all Windows OS Versions
• Interact with Malware Safely

If you want to test all these features now with completely free access to the sandbox:

Try ANY.RUN for FREE

Technical Analysis

Command-and-control (C&C) communications are becoming more and more common among attackers who take advantage of the Microsoft Graph API that was built for integrating Microsoft cloud services.

Graph API access to services such as OneDrive is used by malware families like BirdyClient, Bluelight (Vedalia/APT37 group), Backdoor.Graphon (Harvester group), and Graphite (Swallowtail/APT28 group) for C&C purposes. 

This new approach helps threat actors hide their malicious communications in legitimate cloud traffic, making detection difficult.

Advanced persistent threats that abuse unknown C&C channels created by repurposing cloud integration capabilities raise concerns about the misuse of trusted services.

Microsoft’s Graph API has become increasingly popular for command-and-control (C&C) abuse among various threat groups.

OneDrive and Microsoft 365 Mail were used by SiestaGraph to target an ASEAN country. 

Backdoor.Graphican, an evolved form of older malware, was utilized by the Flea (APT15) group in campaigns against foreign ministries where Graph API and OneDrive served as their C&C infrastructure components. 

GraphStrike is a penetration testing toolkit—one of many examples that illustrates how attackers are abusing legitimate cloud integration capabilities for malicious communication purposes, which helps them hide within trusted services. 

However, as more knowledge about this technique spreads throughout other hacking communities, we should expect authenticated API access to be misused as never before, which will create new challenges for all.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.

To avoid detection, threat actors have started to use Microsoft’s Graph API as a platform for their command-and-control servers. 

This is done so that their malicious communications will seem like normal cloud activities, while at the same time providing them with free, safe hosting using ordinary cloud accounts. 

Accordingly, given its increased adoption by various threat actors aimed at ensuring continuity of operations, misusing authorized API access channels for C2 presents a growing problem that requires more alertness and innovative protection mechanisms.

IoCs

• afeaf8bd61f70fc51fbde7aa63f5d8ad96964f40b7d7fce1012a0b842c83273e – BirdyClient
• 5c430e2770b59cceba1f1587b34e686d586d2c8ba1908bb5d066a616466d2cc6 – Bluelight
• 470cd1645d1da5566eef36c6e0b2a8ed510383657c4030180eb0083358813cd3 – Graphon
• f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231 – Graphite
• 4b78b1a3c162023f0c14498541cb6ae143fb01d8b50d6aa13ac302a84553e2d5 – Graphican
• a78cc475c1875186dcd1908b55c2eeaf1bcd59dedaff920f262f12a3a9e9bfa8 – Graphican
• 02e8ea9a58c13f216bdae478f9f007e20b45217742d0fbe47f66173f1b195ef5  – Graphican
• 1a87e1b41341ad042711faa0c601e7b238a47fa647c325f66b1c8c7b313c8bdf – SiestaGraph
• fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb – SiestaGraph
• 7fc54a287c08cde70fe860f7c65ff71ade24dfeedafdfea62a8a6ee57cc91950 – SiestaGraph

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide