Understanding FinalDraft Malware: Stealthy Threats Exploiting Microsoft 365

A sophisticated new malware variant, dubbed FinalDraft, has recently been discovered abusing Outlook’s email draft feature to conceal its command-and-control (C2) communications. This inventive approach highlights both the cunning nature of modern cyber threats and the challenges defenders face in distinguishing malicious activity from legitimate Microsoft 365 traffic.

A Clever Manipulation of Legitimate Tools​

FinalDraft operates by leveraging a normally benign feature of Outlook—its email drafts—to exchange commands with a compromised system. Rather than sending overt emails that could raise red flags, the malware stealthily uses draft messages to hide its communications. When the malware receives a command from its remote operator, it does so via specially formatted drafts containing session-specific identifiers (for example, using prefixes such as r[I]<session-id> for commands and p[/I]<session-id> for responses). Once executed, these drafts are deleted, further complicating any forensic investigation.
This method exemplifies a dangerous trend where cybercriminals utilize trusted cloud services as a camouflage for nefarious activities. By blending command-and-control data into regular Microsoft 365 traffic, the attackers are able to significantly reduce their detection risk.

The Attack Chain Unpacked​

Understanding FinalDraft’s operation requires a look at its multi-stage attack process:

• Initial Compromise via PathLoader:
  The attackers begin by compromising a target’s system with an innocuous-looking executable named PathLoader. This small program is designed to execute shellcode after bypassing static analysis through API hashing and string encryption. Despite its modest size, PathLoader is a powerful precursor, launching further malicious payloads into the victim’s system.
• Deployment of FinalDraft:
  Once PathLoader is in place, it retrieves and executes the FinalDraft backdoor. This component is responsible for several critical actions, including data exfiltration and process injection. FinalDraft also loads its configuration and generates a unique session ID to facilitate secure communications.
• Exploitation of Microsoft Graph API:
  Integrating deeply with Microsoft’s own APIs, FinalDraft retrieves an OAuth token by using a refresh token that has been hard-coded into its configuration. This token, stored in the Windows Registry for persistent access, allows the malware to masquerade as a legitimate user. Using this token, it interacts with the Microsoft Graph API to fetch, send, and delete Outlook drafts—all without triggering typical outbound alerts.
• Robust Command Set:
  With a repertoire of 37 distinct commands at its disposal, FinalDraft can perform a range of malicious actions:
• Data Exfiltration: Extract files, credentials, and system information.
• Process Injection: Embed unauthorized payloads into trusted processes like mspaint.exe.
• Pass-the-Hash Attacks: Steal and reuse authentication credentials to move laterally within the network.
• Network Proxying: Set up covert tunnels for communication.
• File Operations: Manipulate files through deletion, copying, or overwriting.
• Stealthy PowerShell Execution: Operate without launching the typically detectable powershell.exe.
• Linux Variant:
  Interestingly, researchers also identified a Linux variant of FinalDraft, capable of similar operations via REST API and Graph API integrations, as well as additional communication methods including reverse UDP & ICMP, bind/reverse TCP, and DNS-based exchanges.

The Broader Campaign: REF7707​

FinalDraft is not an isolated malware incident—it forms part of an expansive campaign, codenamed REF7707, which has been linked to cyber-espionage activities targeting high-value institutions. The campaign’s primary target was a South American foreign ministry, although infrastructure analysis shows connections to further incidents across Southeast Asia.
The attackers also employed another malware loader, known as GuidLoader, which aids in decrypting and executing payloads directly in memory. Despite the advanced tactics, a few operational security (opsec) mistakes eventually compromised the threat actors, leading to their exposure by security researchers.

Implications for Windows and Microsoft 365 Users​

For Windows users and organizations relying on Microsoft 365, the FinalDraft incident underscores several critical lessons:

• Stealth Tactics Challenge Traditional Detection:
  When malware uses legitimate services for command-and-control, it becomes harder for standard security solutions to distinguish malicious from normal activity. This emphasizes the need for advanced threat detection mechanisms that monitor behavior anomalies beyond simple signature-based measures.
• Vigilance in API and Token Security:
  The abuse of the Microsoft Graph API demonstrates that even well-protected cloud platforms can be exploited if token management and API security are not rigorously maintained. Regular audits and strict access controls can help mitigate these risks.
• Operational Security Best Practices:
  Enterprises must maintain robust incident response strategies and invest in threat intelligence. By understanding the nuanced techniques used by modern malware such as FinalDraft, IT security teams can be better prepared to detect and neutralize threats early.

What Can You Do?​

Here are a few steps to bolster your defenses:

• Keep Systems Updated:
  Ensure that all security patches, especially for exposed vulnerabilities in Microsoft products and related APIs, are applied promptly.
• Monitor Network Traffic and Logs:
  Look for irregular behavior, such as unusual drafts or API calls, that could indicate malware trying to mimic legitimate activities.
• Educate Your Team:
  Awareness is a powerful tool. Training employees to recognize suspicious behavior and maintaining an updated incident response plan can make all the difference in mitigating an attack.
• Review and Harden API Security:
  Regularly audit your OAuth tokens, access logs, and application permissions to prevent unauthorized access.

Conclusion​

The ingenuity of the FinalDraft malware campaign is a stark reminder that cybercriminals are continually adapting by abusing trusted systems like Outlook and Microsoft Graph API. As organizations increasingly rely on cloud services, maintaining a multi-layered defense strategy becomes paramount. While FinalDraft’s stealthy operations present a formidable challenge, a proactive approach incorporating updated security patches, vigilant monitoring, and comprehensive user education can significantly reduce the risk of similar attacks.
Stay alert, keep your systems patched, and always question the unexpected—even if it’s hiding in your email drafts.

---

Source: BleepingComputer https://www.bleepingcomputer.com/news/security/new-finaldraft-malware-abuses-outlook-mail-service-for-stealthy-comms/