Dissecting FINALDRAFT: Actionable Intel from a State-Sponsored Multi-Platform Backdoor
summary
Custom multiplatform backdoor named Final Draft uses Microsoft Graph API draft emails for C2, stores a refresh token in its config and reads/deletes draft subjects to receive 44-command jobs and upload results; path loader (12 unfinished samples) fetches encrypted shellcode, injects into MS Paint or conhost, and Final Draft supports reverse UDP/TCP/DNS, named-pipe proxies and process injection. Operator lateral movement uses WinRM and CDB.exe as a LOLBIN; multiple pre-production samples and exposed domains reveal South American and Asian victims and aggressive exfiltration that works end-to-end.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:07Research agenda
- 2:34Discovery timeline
- 7:22Initial execution
- 12:32Malware arsenal
- 16:45FinalDraft deep dive
- 27:58Operational security failures
- 30:52Campaign intersections
related talks
52mStart covering your bases & Stop chasing APT headlines
41m"Revenge of The Script Kiddies: Current Day Uses..."
25mCommSec D1 - A Deep Dive Into Malicious Documents
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
43mHunting for Bugs, Catching Dragons
01h 06mHow hacking works
42mStart Covering Your Bases And Stop Chasing APT Headlines