Cybersecurity

GraphWorm Malware Uses Microsoft OneDrive as Command-and-Control Infrastructure

60 sec read2 views0 listens

GraphWorm Malware Uses Microsoft OneDrive as Command-and-Control Infrastructure

Overview:

GraphWorm is a sophisticated malware variant that leverages Microsoft OneDrive for command and control (C2) infrastructure. This approach allows attackers to maintain persistence, exfiltrate data, and deliver payloads with relative ease due to the widespread use of OneDrive in corporate environments.

Key Features:

Persistence Mechanism: GraphWorm employs a sophisticated persistence mechanism that involves creating scheduled tasks and registry entries.
Data Exfiltration: The malware uses Microsoft OneDrive for storing and retrieving configuration files, as well as exfiltrating sensitive data from compromised systems.
Payload Delivery: Attackers can use the C2 infrastructure to deliver additional payloads or update existing malware components.

Malware Components:

GraphWorm includes several key components that work together to achieve its objectives:

SearchApp.exe (Win/Agent.KBuf): This component is responsible for establishing initial persistence and setting up communication channels with the C2 server.
ssh.exe (Win/Hack Tool/Proxy.WQ): Used as a proxy tool to relay commands and data between the compromised system and the attacker's infrastructure.
**svc.exe

Read the full article at Cyber Security News

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

GitHub says internal repositories were taken in poisoned VS Code extension attack

GitHub confirmed that internal repositories were compromised after an employee's device was infected by a malicious Visual Studio Code extension, highlighting the increasing risks to software development platforms and third-party tools. This incident...

Ali Nemati

Cybersecurity6 hours ago22 sec read

Critical flaw in software powering a third of the internet is already being exploited - free checker now available

A critical security vulnerability, CVE-2026-42945, in NGINX, which powers over 30% of websites globally, has been confirmed as actively exploited. This flaw allows attackers to crash servers or gain full control remotely without authentication, posin...

Ali Nemati

Cybersecurity7 hours ago1m & 2 s read

GitHub Breach; Faster Old Problems; and Mythos Helps Bypass Apple M5 Chip Security

It looks like you've provided an excerpt from a cybersecurity newsletter or blog post discussing recent developments in security and technology. Here's a summary of the key points: Vulnerability Exploitation as Primary Attack Vector: According to t...

Ali Nemati

Cybersecurity7 hours ago28 sec read

Sentinels League 2026: Live Rankings for the Threat Hunting World Championship

The Threat Hunting World Championship, Sentinels League 2026, is now open for entries with a new format and increased prize pool. This competition challenges participants to demonstrate their threat-hunting skills across four attack surfaces in high-...

Ali Nemati

Cybersecurity8 hours ago23 sec read

Verizon DBIR finds vulnerability exploitation overtakes stolen credentials as top breach entry point for critical infrastructure

Exploitation of software vulnerabilities has surpassed stolen credentials as the leading cause of breaches in critical infrastructure, accounting for 31% of incidents according to Verizon’s latest DBIR. This shift highlights the urgent need for organ...

Ali Nemati

GraphWorm Malware Uses Microsoft OneDrive as Command-and-Control Infrastructure

GraphWorm Malware Uses Microsoft OneDrive as Command-and-Control Infrastructure

Overview:

Key Features:

Malware Components:

Related Articles

GitHub says internal repositories were taken in poisoned VS Code extension attack

Critical flaw in software powering a third of the internet is already being exploited - free checker now available

GitHub Breach; Faster Old Problems; and Mythos Helps Bypass Apple M5 Chip Security

Sentinels League 2026: Live Rankings for the Threat Hunting World Championship

Verizon DBIR finds vulnerability exploitation overtakes stolen credentials as top breach entry point for critical infrastructure