FINALDRAFT Malware: Exploiting Microsoft Outlook and Graph API for Covert Attacks

2025-02-13

In the ever-evolving world of cyber threats, security researchers at Elastic Security Labs have uncovered a new strain of malware known as FINALDRAFT. This sophisticated malware leverages Microsoft Outlook and the Microsoft Graph API to carry out covert command-and-control (C2) operations, marking a worrying trend in the abuse of legitimate cloud services by cybercriminals. The malware was first identified during an investigation into a breach of a foreign ministry, underscoring the increasing complexity of espionage-focused cyberattacks.

Overview of FINALDRAFT Malware

FINALDRAFT is a remote administration tool (RAT) that operates primarily on 64-bit Windows systems. Developed in C++, it comes bundled with a custom loader, named PATHLOADER, which retrieves encrypted shellcode from external servers. This shellcode is decrypted and executed to activate the malware. Once running, FINALDRAFT utilizes the Microsoft Graph API to interact with Outlook’s draft email folder for its C2 communications. Commands from attackers are hidden in email drafts, while responses are sent back to the attackers in the same way, making it difficult for traditional email monitoring systems to detect malicious activity.

FINALDRAFT’s command set is extensive, with 37 handlers supporting a variety of malicious functions such as process injection, file manipulation, and network proxying. The malware also employs advanced evasion techniques, such as executing PowerShell commands without triggering the usual “powershell.exe” process and using stolen NTLM hashes to move laterally through compromised networks.

To avoid detection, FINALDRAFT obfuscates its operations through string encryption and API hashing. The malware’s integration with legitimate services like Microsoft Graph API and Outlook highlights the increasing complexity and sophistication of modern cyberattacks. Additionally, Elastic Security Labs discovered a Linux variant of FINALDRAFT, expanding its potential impact across different platforms.

What Undercode Says:

The FINALDRAFT malware campaign exemplifies the growing trend of attackers using legitimate cloud services for covert operations. By exploiting the Microsoft Graph API, which provides seamless access to various Microsoft 365 services such as Outlook, attackers can hide their malicious activities within legitimate traffic, making detection much harder. This approach is not new but represents a more advanced evolution of tactics seen in previous campaigns, such as SIESTAGRAPH and BirdyClient.

The fact that FINALDRAFT relies on email drafts as a medium for communication shows a clever use of everyday tools. Email drafts are often overlooked in security monitoring, as they are not considered part of normal email traffic, which makes them an ideal vehicle for carrying out attacks undetected. By sending commands in one draft and receiving responses in others, the malware can operate in the background without raising alarms.

Moreover, the incorporation of advanced evasion techniques like process injection and lateral movement through NTLM hashes demonstrates how modern malware is becoming increasingly complex and capable of adapting to its environment. The ability to execute PowerShell commands without invoking “powershell.exe” shows that even familiar tools are being exploited in ways that evade traditional detection methods.

The cross-platform nature of FINALDRAFT, with its Linux variant, also signals a shift towards more versatile and adaptable cyberattacks. Attackers are no longer limited to targeting just Windows systems but are now expanding their reach to other platforms, complicating defense strategies further. The use of multiple C2 transport protocols, including HTTP/HTTPS and reverse UDP, ensures that FINALDRAFT remains resilient to attempts at disruption.

In terms of defense, organizations must remain vigilant and proactive. The traditional focus on email security alone is no longer enough to combat such sophisticated threats. Monitoring email drafts, OAuth token usage, and anomalous cloud service activity is now a critical part of the detection process. Additionally, implementing strict access controls for cloud services and deploying advanced endpoint detection tools are essential measures to counter such evolving threats.

What’s particularly concerning is the apparent ongoing development of FINALDRAFT, as indicated by the discovery of its Linux variant and diverse communication protocols. As attackers continue to innovate, security teams must stay one step ahead, continuously evolving their defense strategies to counteract the increasing sophistication of these espionage-driven cyberattacks.

In conclusion, FINALDRAFT highlights the need for a more comprehensive approach to cybersecurity, one that not only focuses on traditional methods but also adapts to the growing use of cloud-based services and legitimate APIs by cybercriminals. The rise of such threats emphasizes the importance of vigilance, timely detection, and advanced threat-hunting techniques to defend against the next generation of cyberattacks.

References:

Reported By: https://cyberpress.org/new-malware-uses-outlook-and-microsoft-graph-api/
https://www.github.com
Wikipedia: https://www.wikipedia.org
Undercode AI: https://ai.undercodetesting.com