Threat Intel
FINALDRAFT Malware Uses Microsoft Graph API for C2 in Espionage Campaign
Elastic Security Labs uncovered a new espionage malware family, FINALDRAFT, that leverages Outlook and Microsoft Graph API for command and control. The kit includes a lightweight Windows loader, PATHLOADER, and a Linux variant, using typosquatted domains and API hashing to evade analysis. Defenders should block the identified domains, monitor Graph API traffic, and detect PATHLOADER execution.
During a recent investigation, Elastic Security Labs identified a new malware family targeting a foreign ministry. The package, named FINALDRAFT, is delivered through a small Windows loader called PATHLOADER and includes a Linux variant. Both components use Outlook and Microsoft Graph API to communicate with command‑and‑control servers.
What Happened
PATHLOADER is a 206 KB Windows PE that downloads encrypted shellcode from a remote server. The shellcode is then executed on the victim machine, creating the FINALDRAFT implant. The loader embeds a configuration string that points to two typosquatted domains resembling security‑vendor URLs.
Impact
- Targets high‑value government environments.
- Provides a full post‑exploitation kit with loader, backdoor, and sub‑modules.
- Uses API hashing (FNV‑0x1000193) and string obfuscation to avoid static analysis.
What to Do
Defenders should:
- Block outbound traffic to poster.checkponit.com and support.fortineat.com.
- Inspect outbound Microsoft Graph API calls for suspicious Outlook activity.
- Deploy detection rules for the PATHLOADER binary size and hash patterns.
- Monitor for execution of encrypted shellcode in the system memory.
Early detection of the loader and blocking of the typosquatted domains can prevent the implant from establishing a foothold.
Related articles
Chinese Espionage Group Deploys New SparroWocky Backdoor in Latin America
FamousSparrow, a China‑linked threat actor, has moved beyond its old SparrowDoor tool and rolled out the modular C++ backdoor SparroWocky against government entities across Latin America. The malware uses sophisticated anti‑analysis tricks—DLL side‑loading, RC4‑encoded payloads, dynamic API resolution, and CreateThread hooking—to evade detection. It can execute commands, exfiltrate data, capture high‑frequency screenshots, proxy traffic, and even wipe its own traces. ESET’s analysis pinpoints 18 C2 endpoints and shows the operation has been active for over a year, targeting Argentina, Ecuador,
Read briefing
NeedyMantis: Modular Post‑Compromise Malware Used in Targeted Attacks
Microsoft Threat Intelligence has identified NeedyMantis, a modular post‑compromise malware framework used to maintain long‑term access in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware, first seen in October 2025, combines custom loaders, encrypted archives and extensible components to evade analysis and support follow‑on operations. Defenders should monitor for its indicators, block its C2 domains, and apply Microsoft Defender detections.
Read briefing
DPRK Lazarus‑style Attack Targets macOS Blockchain Engineers via Discord‑Delivered Python Bot
North Korean actors leveraged a disguised Python arbitrage bot sent through a public Discord channel to compromise macOS systems of blockchain engineers. The multi‑stage malware, KANDYKORN, performs in‑memory binary loading and uses several evasion techniques. Defenders should block the ZIP, monitor for Watcher.py execution, and harden Discord access.
Read briefing
PIKABOT Loader Update: New Unpacking, Obfuscation, and Phishing Campaigns
Elastic Security Labs uncovered a new PIKABOT loader variant that uses scattered base64 chunks, inline RC4 decryption, and plaintext configuration to evade detection. The campaign delivers the loader via ZIP attachments in phishing emails and launches PowerShell to download the payload. Defenders should block ZIPs from unknown senders, monitor for suspicious PowerShell activity, and update detection rules for the new unpacking pattern.
Read briefing