Graph: Growing number of threats leveraging Microsoft API


An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services.

The technique was most recently used in an attack against an organization in Ukraine, where a previously undocumented piece of malware used the Graph API to leverage Microsoft OneDrive for C&C purposes.

Read more…
Source: Symantec


Sign up for our Newsletter


Related:

  • For the fourth month in a row, Microsoft patches Windows zero-day used in the wild

    December 11, 2018

    Today, Microsoft released its monthly security patches –known as the Patch Tuesday updates. This month the Redmond-based company fixed 38 vulnerabilities across a large set of products. For the fourth month in a row, Microsoft patched a Windows OS zero-day vulnerability that was being exploited in the wild. Just like in the last two months, and for ...

  • Microsoft patches Windows zero-day used by multiple cyber-espionage groups

    November 13, 2018

    Microsoft released today its monthly roll-up of security patches known as Patch Tuesday. This month, the Redmond-based company has fixed 62 security flaws. Among the 62 fixes, there is also a fix for a zero-day vulnerability that was under active exploitation before today’s patches were made available. The zero-day, tracked as CVE-2018-8589, impacts the Windows Win32k component. Microsoft ...

  • Microsoft regularly shared data of India bank customers with US intelligence agencies, claims report

    November 2, 2018

    Technology company Microsoft has routinely shared the financial details of Indian bank customers with intelligence agencies in the United States, DNA reported on Tuesday. According to the newspaper, the Reserve Bank of India flagged its concerns on the matter in a risk assessment report it has placed before banks’ audit committees. The central bank found that the data ...

  • SettingContent-ms can be Abused to Drop Complex DeepLink and Icon-based Payload

    October 18, 2018

    Microsoft’s SettingContent-ms has become a recent topic of interest. In July, we saw one spam campaign use malicious SettingContent-ms files embedded in a PDF to drop the remote access Trojan FlawedAmmyy, a RAT also used by the Necurs botnet. That campaign was mostly targeting banks in different countries across Asia and Europe. SettingContent-ms is a recent addition to ...

  • Microsoft Has Pulled the Windows 10 October 2018 Update

    October 6, 2018

    The users recently discovered a critical bug in Windows 10 October 2018 Update (version 1809) that causes an unexpected removal of files such as documents and pictures during the upgrade process. There’s a growing number of users reporting the same problem and Microsoft has finally paused the rollout of Windows 10 October 2018 Update. Today, Microsoft announced in a support document that ...

  • Microsoft Detection Tools Sniff Out Fileless Malware

    October 2, 2018

    Microsoft recently reported that their advanced threat protection tools were able to detect and block two heavily obfuscated and malicious scripts. The threats were apparently using the Sharpshooter technique, which was documented and published in a 2017 blog post from a British security firm. A report from the company details the elusive payload—it did not trigger antivirus scanning, was loaded ...