Dissecting FINALDRAFT: Actionable Intel from a State-Sponsored Multi-Platform Backdoor

Dissecting FINALDRAFT: Actionable Intel from a State-Sponsored Multi-Platform Backdoor

Speakers: Salim Bitam, Senior Security Research Engineer, Elastic Security Labs

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=34n14ey_oxs

Overview

In a revealing presentation at CODE BLUE, Salim Bitam, a Senior Security Research Engineer at Elastic Security Labs, unveiled the intricacies of FINALDRAFT, a sophisticated multi-platform backdoor attributed to a state-sponsored threat actor. This talk, titled "Dissecting FINALDRAFT: Actionable Intel from a State-Sponsored Multi-Platform Backdoor," provided an in-depth analysis of the malware's architecture, operational tactics, and the attacker's notable operational security (OPSEC) failures. The research, a collaborative effort by Elastic Security Labs, sheds light on advanced persistent threat (APT) methodologies, offering critical insights for the broader cybersecurity community.

The core of FINALDRAFT's ingenuity lies in its abuse of the Microsoft Graph API for command and control (C2) communications, leveraging draft emails as a covert channel. This novel approach, combined with its multi-platform capabilities (Windows and Linux variants) and modular design, underscores the evolving sophistication of state-sponsored adversaries. Bitam's presentation detailed the initial intrusion vectors, post-exploitation activities, and a comprehensive breakdown of the associated malware arsenal, including PathLoader and GridLoader. The findings are particularly significant for defenders, providing actionable intelligence to detect, respond to, and ultimately prevent similar intrusions by this advanced threat actor.

Background

▶ Watch: Introduction and talk agenda (0:00)

The journey to uncovering FINALDRAFT began around November 2024, with Elastic Security Labs publishing their initial findings in February 2025 across two blog posts: one focused on malware analysis and the other on campaign analysis. The initial detection stemmed from observing suspicious usage of certutil.exe downloading files via lateral movement commands, a common but often overlooked indicator of compromise. This anomaly prompted a deeper investigation, which quickly revealed a highly organized and well-resourced adversary.

Victim profiling indicated a primary target in a South American entity, with subsequent discoveries pointing to an Asian entity as well. A significant aspect of this research was the attacker's weak OPSEC, which inadvertently exposed pre-production malware versions, additional infrastructure, and other compromised victims. This allowed researchers to gain an unprecedented view into the adversary's development cycles and broader operational scope. The Elastic team also noted a strong overlap with their prior 2022 research on REF 2924, which featured a malware named Ciesta Graph, also known for its use of the Graph API for C2 communication, suggesting a potential evolution or shared lineage of TTPs.

The timeline of the adversary's activities revealed a methodical approach to infrastructure setup and malware development. Domains such as checkpoint.com and autodiscover.com, used to host shellcodes and malware, were registered around mid-2022. Early versions of PathLoader appeared in early 2023, followed by GridLoader in mid-2023. The first observed intrusion with FINALDRAFT and its ELF version occurred in late 2024, indicating a prolonged development and deployment cycle. This continuous evolution, including recent observations of heavy code obfuscation and direct code with stack spoofing techniques, highlights the persistent and adaptive nature of this state-sponsored threat actor.

Key Findings

▶ Watch: Initial execution chain using LoLBin cdb.exe (7:40)

The Elastic Security Labs research into FINALDRAFT yielded several pivotal findings that redefine understanding of state-sponsored malware capabilities and adversary tactics. Foremost among these is the identification of FINALDRAFT as a custom-built, multi-platform modular backdoor. Its modularity allows for flexible deployment and tailored functionality across diverse environments, specifically targeting both Windows and Linux operating systems.

A standout discovery is FINALDRAFT's innovative C2 communication mechanism, which ingeniously abuses the Microsoft Graph API. Instead of traditional network channels, the malware leverages legitimate draft emails within compromised Office 365 accounts to send and receive commands and exfiltrate data. This method provides an exceptional level of stealth, blending malicious traffic with legitimate enterprise network activity.

The attackers demonstrated a sophisticated understanding of system internals and evasion techniques, notably employing LOLBINs (Living Off The Land Binaries) for fileless execution. Specifically, they weaponized the Windows debugger cdb.exe (often renamed to fdvhost.exe), configuring it to inject shellcode into benign processes like mspaint.exe or conhost.exe. This approach minimizes the footprint of custom executables and complicates detection efforts.

Crucially, the adversary's significant OPSEC failures played a vital role in unraveling their operations. These missteps included exposing pre-production malware samples, revealing additional C2 infrastructure, and inadvertently allowing researchers to identify other compromised victims. These errors provided invaluable insights into the attacker's development processes, their full toolkit, and the broader scope of their campaigns, which would have otherwise remained hidden.

Finally, the research meticulously documented the full malware arsenal associated with this threat actor, including the payload loader PathLoader and the development-stage GridLoader. This comprehensive view of their tools, from initial access to persistent control, offers a holistic understanding of their operational capabilities and provides defenders with specific artifacts for detection and mitigation.

Technical Deep Dive

▶ Watch: Deep dive into Graph API C2 via draft emails (19:50)

The initial execution chain observed in FINALDRAFT intrusions is a testament to the attacker's ability to leverage built-in Windows features and common tools for stealth and persistence. The attack typically commenced with winrshost.exe, indicating remote command execution via WinRM (Windows Remote Management) from one machine to another. Subsequently, certutil.exe was used to download the initial toolkit, including fdvhost.exe and a configuration file, config.ini, from attacker-controlled infrastructure.

Crucially, fdvhost.exe was identified as a renamed cdb.exe, the legitimate Windows debugger. This LOLBIN was weaponized by feeding it the config.ini file, which contained embedded code designed to inject the FINALDRAFT backdoor into mspaint.exe or conhost.exe. This technique effectively disguised the malicious activity within legitimate processes, making it harder to detect.

Post-exploitation activities were extensive and systematic. The attackers performed connectivity checks by pinging well-known services like microsoft.com and google.com using cmd.exe and powershell.exe. Enumeration was thorough, involving numerous commands to gather system information, query registries, and collect domain details. Notably, they extracted security and system registry hives, including the SAM and NTDS.it files, for credential harvesting. Persistence was established by creating scheduled tasks that executed the renamed debugger (fdvhost.exe) and its weaponized configuration file, set to run every minute with system privileges.

The malware arsenal supporting FINALDRAFT comprises several distinct components:

• GridLoader: This appeared to be a development or testing-phase malware. Elastic observed 12 samples, characterized by unfinished routines, broken functionality, and debug information, providing a rare glimpse into the adversary's development process.
• PathLoader: A Windows PE file, PathLoader serves as the initial payload loader. It connects to hardcoded C2 servers (e.g., checkpoint.com, autodiscover.com) to download an encrypted shellcode. This shellcode is then decrypted using the Windows cryptographic library (AES algorithm, B64 encoded) and injected into memory. PathLoader exhibited minimal code obfuscation and a basic anti-sandboxing technique involving a sleep method. String obfuscation was achieved using SIMD instructions and XMM registers.
• FINALDRAFT: The core of the operation, FINALDRAFT is a sophisticated, modular backdoor written in C++. It typically manifests as a DLL, exporting a single entry point (e.g., update_task). Its configuration is XOR encrypted and hardcoded within the binary's .data section. The decryption key is either derived from the Windows product ID or a specific string located after the encrypted blob. Interestingly, some configurations included a Pastebin URL, which researchers believe was used to track the number of active malware instances.

FINALDRAFT's capabilities are extensive, encompassing 44 distinct commands:

• Information Collection: Gathers system information, public IP addresses (via legitimate services).
• Process Injection: Multiple methods, communicating with child processes via named pipes.
• Proxy Functionality: Can act as a proxy through UDP, TCP, or named pipes, and modify Windows firewall rules. It establishes TCP connections by sending and expecting a specific magic value.
• File Manipulation: Overwrites file data with zeros before deletion to prevent recovery. It uses CopyFileW API for copying, falling back to NTFS cluster-level copy if the API call fails.

The most distinctive feature is its Microsoft Graph API C2 communication. FINALDRAFT stores a refresh token in its configuration. It uses this token to obtain an access token, which is then stored in a registry key. For C2, it creates "session emails" with a specific subject structure (e.g., B_sessionID) in the draft folder of a compromised Office 365 account. Commands for the malware are written into draft emails with a subject like R_sessionID. FINALDRAFT queries the last five draft emails, extracts commands, and deletes them. The output of executed commands is then written back into new draft emails with a subject like P_sessionID. All message requests and responses are zip-compressed, AES-encrypted (key from configuration), and base64 encoded, further enhancing stealth.

FINALDRAFT also loads several additional modules dynamically via process injection, often using SRDI shellcode to reflectively load DLLs into memory. These modules communicate with FINALDRAFT via named pipes and are password-protected, requiring a correct password before execution:

• Network Enumeration Module (IPconfig.x64.dll): Replicates ipconfig functionality using APIs like GetAdaptersAddresses, GetAdaptersInfo, and GetNetworkParameters.
• PowerShell Execution Module (PSloader.x64.dll): Similar to PowerSploit, it can receive and execute PowerShell scripts and has a feature to disable AMSI (Antimalware Scan Interface).
• Pass-the-Hash Toolkit (PNT.x64.dll): Heavily inspired by Mimikatz, this module takes domain, account name, NTLM hash, and a target binary. It creates the target process in a suspended state, identifies key structures within LSASS (Local Security Authority Subsystem Service), and overwrites the credential structure with the supplied NTLM hash for privilege escalation.

A Linux variant of FINALDRAFT was also discovered. While it supports more C2 transport channels (e.g., reverse UDP, reverse TCP, DNS, and Graph API), it has fewer commands and features compared to its Windows counterpart. Pre-production samples of FINALDRAFT allowed researchers to trace the evolution of the codebase, observing commands present in older versions that were later removed, providing insights into the adversary's development priorities and refinements.

Demo / Proof of Concept

▶ Watch: FinalDraft's advanced modules: PowerShell, Pass-the-Hash (24:00)

While the talk did not feature a live, interactive demonstration of the FINALDRAFT malware by the speaker, Salim Bitam extensively detailed the observed attacker behaviors and capabilities, effectively serving as a retrospective demonstration of the adversary's operational tactics. The presentation meticulously walked through the initial infection chain, the post-exploitation commands executed, and the intricate workings of the malware arsenal.

Crucially, the Elastic Security Labs team leveraged their findings to perform internal emulation of the attacker's C2 server. This emulation process allowed them to safely trigger and observe every feature of the malware on demand, generating clean and reliable telemetry for each specific malicious behavior. This method acts as a robust proof-of-concept for understanding the threat, enabling the development of precise detection rules, refining hunting queries, and training security systems. The ability to simulate real-world attack scenarios based on discovered malware capabilities is a powerful "proof of concept" for validating pre-existing detection rules and enhancing overall defensive posture.

Defensive Implications

▶ Watch: Campaign intersection and attribution by other vendors (30:40)

The detailed analysis of FINALDRAFT offers several critical defensive implications for organizations facing sophisticated, state-sponsored threats. Implementing robust detection and prevention strategies based on the observed tactics, techniques, and procedures (TTPs) is paramount.

Firstly, organizations should focus on initial access vectors and LOLBIN abuse. Monitoring for certutil.exe downloading files from untrusted or unusual sources is a crucial early warning. More specifically, vigilance is required for cdb.exe (or any renamed variants like fdvhost.exe) being launched by non-developer processes, particularly when coupled with suspicious configuration files or process injection attempts into common Windows applications like mspaint.exe or conhost.exe. Behavioral detection rules should be tuned to flag these anomalous debugger executions.

Post-exploitation activities also provide key detection opportunities. Alerting on attempts to copy sensitive files like the SAM and NTDS.it hives, even with legitimate tools, is vital for preventing credential theft. Network signatures should be developed to identify processes beaconing to Microsoft Graph API endpoints, especially when the traffic patterns deviate from typical legitimate usage, or when originating from unusual processes. While Graph API usage is legitimate, anomalous patterns or contexts can indicate compromise.

For module-specific detection, defenders can create rules to detect the powershell_engine being loaded by PSloader.x64.dll or similar modules, indicating PowerShell execution by the backdoor. Similarly, monitoring for WriteProcessMemory API calls targeting other processes for injection, a common technique for loading FINALDRAFT's modules, can reveal malicious activity. The use of named pipes for inter-process communication between FINALDRAFT and its modules also presents an opportunity for behavioral analytics.

Finally, the Elastic team highlighted the strategic advantage of emulating attacker C2 servers. By safely triggering and observing all of the malware's features on demand, security teams can generate precise telemetry. This process is invaluable for:

• Developing highly accurate detection rules.
• Creating effective hunting queries.
• Training security analysts and automated systems.
• Validating the efficacy of pre-existing detection rules against known threats.
• Simulating real-world attack scenarios to test defensive capabilities proactively.

By integrating these defensive measures, organizations can significantly enhance their resilience against FINALDRAFT and similar multi-platform, state-sponsored backdoors.

Key Takeaways

• State-Sponsored Sophistication: FINALDRAFT is a multi-platform (Windows and Linux) modular backdoor developed by a sophisticated, state-sponsored threat actor, showcasing advanced capabilities and persistent development.
• Covert C2 via Graph API: The malware uniquely abuses the Microsoft Graph API, utilizing draft emails within compromised Office 365 accounts for stealthy command and control communication and data exfiltration.
• LOLBIN Abuse for Fileless Execution: Attackers leverage Living Off The Land Binaries (LOLBINs) like the Windows debugger cdb.exe (often renamed) to achieve fileless execution and inject malicious payloads into benign processes, complicating detection.
• OPSEC Failures Provide Intelligence: The adversary's significant operational security (OPSEC) missteps exposed pre-production malware, additional infrastructure, and compromised victims, offering invaluable insights into their toolkit and development lifecycle.
• Modular Arsenal & Persistence: FINALDRAFT operates with a modular arsenal including PathLoader and specialized modules for network enumeration, PowerShell execution (disabling AMSI), and Mimikatz-inspired Pass-the-Hash attacks, often establishing persistence via scheduled tasks.
• Actionable Defensive Strategies: Detection efforts should focus on anomalous certutil.exe and cdb.exe usage, Graph API beaconing patterns, sensitive file access (SAM/NTDS.it), and process injection techniques, complemented by C2 emulation for robust rule development.

About the Speaker(s)

Salim Bitam is a Senior Security Research Engineer at Elastic Security Labs. His expertise lies in malware research and reverse engineering, contributing significantly to the discovery and analysis of novel threats. Prior to his role at Elastic, Salim gained valuable experience in red teaming, which provides him with a unique attacker's perspective in understanding and dissecting malicious operations. He is also an active participant in the Flare-On challenge, having engaged with the prestigious reverse engineering competition since 2018, underscoring his deep technical skills and dedication to the cybersecurity field.