Graph: Growing number of threats leveraging Microsoft API


An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services.

The technique was most recently used in an attack against an organization in Ukraine, where a previously undocumented piece of malware used the Graph API to leverage Microsoft OneDrive for C&C purposes.

Read more…
Source: Symantec


Sign up for our Newsletter


Related:

  • Unit 42 Discovers 13 New Vulnerabilities Across Microsoft and Adobe Products

    December 19, 2019

    Palo Alto Networks’ Unit 42 threat researchers have been credited with discovering six new vulnerabilities addressed by the Adobe Product Security Incident Response Team (PSIRT) as part of its December Adobe Security Bulletin APSB19-55 security updates. Additionally, seven new “important” rated vulnerabilities were addressed by the Microsoft Security Response Center (MSRC) as part of its September, October and November ...

  • Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities

    December 12, 2019

    Many of today’s threats evolve to incorporate as many living-off-the-land techniques as possible into the attack chain. The PowerShell-based downloader Trojan known as sLoad, however, puts all its bets on BITS. Background Intelligent Transfer Service (BITS) is a component of the Windows operating system that provides an ability to transfer files in an asynchronous and throttled fashion using ...

  • High-Severity Windows UAC Flaw Enables Privilege Escalation

    November 20, 2019

    Researchers disclosed details of a high-severity Microsoft Windows vulnerability that could give attackers elevated privileges – ultimately allowing them to install programs, and view, change or delete data. The bug stems from User Account Control (UAC), a security feature of Windows within Secure Desktop which helps prevent unauthorized changes to the operating system. “With UAC fully ...

  • AWS is challenging Microsoft’s $10 billion JEDI contract win

    November 14, 2019

    It’s not surprising, but as of today, November 14, it is official: Amazon AWS is protesting the U.S. Department of Defense’s award of its $10 billion cloud contract to Microsoft. AWS made the company’s decision to file paperwork to challenge the Joint Enterprise Defense Infrastructure (JEDI) public inside the company during an all-hands meeting on November ...

  • Microsoft patches two zero-days in massive September 2019 Patch Tuesday

    September 10, 2019

    Microsoft has published today 80 security fixes across 15 products and services, as part of the company’s monthly batch of security updates, known as Patch Tuesday. Of the 80 vulnerabilities patched today, two are so-called zero-days — security flaws that had been exploited in the wild before Microsoft released fixes. The two zero-days are CVE-2019-1214 and CVE-2019-1215. Both are ...

  • Microsoft Lab Offers $300K For Working Azure Exploits

    August 5, 2019

    In an attempt to sniff out bugs in its Azure cloud platform, Microsoft announced at Black Hat USA 2019 on Monday that it will offer rewards of up to $300,000 for researchers who launch successful test exploits for the platform. Microsoft has launched a dedicated Azure cloud host testing environment, dubbed Azure Security Lab. The exclusive program will ...