You've Got Malware: FINALDRAFT Hides in Your Drafts
Essential information
- Published
- 14/02/2025 15:42
- Modified
- 14/02/2025 15:46
- Tags
- 2025-02-14 elf elf variant finaldraft linux lsass microsoft graph mimikatz ntlm hash outlook pathloader pe powershell ref7707 shell updatetask
- Related entities
- 9 observables, 12 techniques (mitre), 1 malware
Description
While investigating REF7707, Elastic Security Labs discovered a new family of previously unknown malware that leverages Outlook as a communication channel via the Microsoft Graph API. This post-exploitation kit includes a loader, a backdoor, and multiple submodules that enable advanced post-exploitation activities.