Revoking the token didn’t kill the backdoor

Source: CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4223975/revoking-the-token-didnt-kill-the-backdoor.html

https://www.csoonline.com/article/4223975/revoking-the-token-didnt-kill-the-backdoor.html

ONE SENTENCE SUMMARY:

GraphWorm uses Microsoft Graph/OneDrive C2 and can remotely swap OAuth identities, making token revocation insufficient without endpoint isolation.

MAIN POINTS:

  1. Typical identity runbooks prioritize revoking tokens to end session-based compromise.
  2. GraphWorm communicates via Microsoft Graph, using OneDrive as a dead-drop C2.
  3. Tasking uses encrypted job/result folders plus heartbeat and fingerprint files.
  4. Network controls struggle because traffic looks like normal Microsoft 365 TLS activity.
  5. Implant stores client ID, client secret, tenant ID, and long refresh token in cleartext.
  6. Victim ID is hardware-derived, resisting containment via hostname, subnet, or egress changes.
  7. An upgrade command replaces all credentials and scopes from a single task.
  8. Operator can recover immediately after token revocation by switching to a spare OneDrive identity.
  9. Effective detection relies on cloud telemetry: app ID, tenant anomalies, user-agent, file names.
  10. Containment must target the app registration and endpoint behavior, not just token artifacts.

TAKEAWAYS:

  1. Reframe token revocation as a delay when adversaries control application identities.
  2. Sequence response to block channel access while burning credentials, not afterward.
  3. File platform suspension requests early because third-party tenant action can be slow.
  4. Query sign-in telemetry for fixed malicious application IDs to confirm exposure quickly.
  5. Focus hunts on endpoint-resident code and repeatable behaviors attackers can’t cheaply replace.