GraphiteMalware
Trellix describes Graphite as a malware using the Microsoft Graph API and OneDrive for C&C. It was found being deployed in-memory only and served as a downloader for Empire.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1001Data Obfuscation
“T1001”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“T1056.001”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Predators for Hire: Commercial Surveillance Vendors Overview“For instance, Paragon Solutions, the company selling Graphite Spyware was founded in 2020 by Ehud Schneorson, an ex-commander of 8200.”
-
Sednit recargado: un APT histórico reactiva su arsenal“…y hasta hace poco, los implants de alto nivel de Sednit rara vez se observaron in the wild (con unas pocas excepciones, como el malware Graphite, documentado por Trellix en 2021), mientras que el grupo incrementó sus operaciones de phishing.”
-
Sednit reloaded: Back in the trenches“…nce then, and until recently, Sednit’s high-end implants have rarely been observed in the wild (with only a few exceptions, such as the Graphite malware documented by Trellix in 2021), while the group simultaneously ramped up its phishing operations.”
Indicators in its reports
named in the reports above- d0db619a7a160949…151bf9775c32in 2 reports
- 99b454262dc26b08…82a49d334e5ein 2 reports
- 5603e99151f8803c…4d071542f01bin 2 reports
- 6d39f49aa11ce057…9bae423ce3d5in 2 reports
- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.