An unnamed media group in South Asia was focused in November 20233 utilizing a beforehand undocumented Go-based backdoor referred to as GoGra.
“GoGra is written in Go and makes use of the Microsoft Graph API to work together with a command-and-control (C&C) server hosted on Microsoft mail companies,” Symantec, a part of Broadcom, said in a report shared with The Hacker Information.
It is at the moment not clear the way it’s delivered to focus on environments. Nevertheless, GoGra is particularly configured to learn messages from an Outlook username “FNU LNU” whose topic line begins with the phrase “Enter.”
The message contents are then decrypted utilizing the AES-256 algorithm in Cipher Block Chaining (CBC) mode utilizing a key, following which it executes the instructions by way of cmd.exe.
The outcomes of the operation are then encrypted and despatched to the identical consumer with the topic “Output.”
GoGra is claimed to be the work of a nation-state hacking group often known as Harvester owing to its similarities to a customized .NET implant named Graphon that additionally makes use of the Graph API for C&C functions.
The event comes as menace actors are more and more benefiting from respectable cloud companies to remain low-key and keep away from having to buy devoted infrastructure.
A few of the different new malware households which have employed the approach are listed beneath –
- A beforehand unseen information exfiltration software deployed by Firefly in a cyber assault concentrating on a navy group in Southeast Asia. The harvested info is uploaded to Google Drive utilizing a hard-coded refresh token.
- A brand new backdoor dubbed Grager that was deployed in opposition to three organizations in Taiwan, Hong Kong, and Vietnam in April 2024. It makes use of the Graph API to speak with a C&C server hosted on Microsoft OneDrive. The exercise has been tentatively linked to a suspected Chinese language menace actor tracked as UNC5330.
- A backdoor often known as MoonTag that incorporates performance for speaking with the Graph API and is attributed to a Chinese language-speaking menace actor
- A backdoor referred to as Onedrivetools that has been used in opposition to IT companies firms within the U.S. and Europe. It makes use of the Graph API to work together with a C&C server hosted on OneDrive to execute obtained instructions and save the output to OneDrive.
“Though leveraging cloud companies for command and management isn’t a brand new approach, increasingly more attackers have began to make use of it lately,” Symantec stated, pointing to malware like BLUELIGHT, Graphite, Graphican, and BirdyClient.
“The variety of actors now deploying threats that leverage cloud companies means that espionage actors are clearly learning threats created by different teams and mimicking what they understand to achieve success strategies.”
