Revoking the token didn’t kill the backdoor
Analysis of the GraphWorm implant shows Webworm operators rotate OAuth credentials to survive token revocation, using OneDrive dead-drop C2 invisible to network defenses.
The researcher reverse-engineered GraphWorm, a custom implant linked to the China-nexus Webworm group, which uses a OneDrive account as a dead-drop C2 channel over Microsoft Graph with cleartext credentials embedded in the binary. An 'upgrade' command lets operators swap all five OAuth credentials to a backup OneDrive account, so token revocation merely delays reconnection. The implant identifies victims by hashing the network adapter's MAC address with CPU and disk serial numbers pulled via WMI, defeating hostname or network-based containment.
- GraphWorm uses a OneDrive dead drop over Microsoft Graph with no suspicious network indicators
- Upgrade command rotates all five OAuth credentials to a backup account, defeating token revocation
- Victim fingerprint hashes MAC address plus CPU and disk serials via WMI
- Researcher advises hunting on the identity plane and blocking application registrations early
- ATT&CK
- T1102.001 Dead Drop ResolverT1550.001 Application Access TokenT1047 Windows Management InstrumentationT1573 Encrypted Channel
- Vendors
- Microsoft
- Products
- OneDriveMicrosoft Graph
- Threat actors
- Webworm
- Malware
- GraphWorm
From the original article
5 min read at csoonline.com
Every identity-compromise runbook I have written, read or inherited has the same step near the top: revoke the tokens. Reset the password, kill the sessions, invalidate the refresh tokens, then go hunting. It is the right instinct.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.