Loading malware…
Graphite is a Windows backdoor associated with APT28, also known as Fancy Bear and Sednit, that uses the Microsoft Graph API and attacker-controlled OneDrive accounts for command-and-control. Publicly identified in January 2022, it was observed in an espionage campaign active during October–November 2021 against high-ranking government officials and defense interests in Western Asia and Eastern Europe. Documented infection chains used spear-phishing emails with malicious Excel attachments exploiting the MSHTML remote code execution vulnerability CVE-2021-40444, followed by a downloader that executed Graphite in memory.
Graphite collects running-process information, the Windows version, and the installed .NET CLR version, and uploads this reconnaissance data and task results through OneDrive. It polls for encrypted operator tasks and supports commands to resend system information and execute supplied shellcode. Communications data is compressed with LZNT1 and encrypted using AES-256-CBC. The implant periodically renews OAuth2 access tokens and deletes processed task files. In-memory execution, encrypted strings, dynamic API resolution, and communications through legitimate Microsoft infrastructure reduce its exposure to detection.
Graphite has delivered reflectively loaded Empire stagers, ultimately enabling remote control through an Empire agent. Associated deployment chains have used COM hijacking for persistence. Subsequent reporting links Graphite to APT28, although the initial campaign attribution was tentative.
This Windows implant is distinct from the identically named Graphite mobile spyware developed by Paragon Solutions. The two names refer to separate malware products; their capabilities, platforms, and attribution should not be conflated.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Attacks began with spear-phishing emails that delivered an Excel downloader containing a remote code execution exploit (CVE-2021-40444). This led to the installation of a second-stage downloader, followed by Graphite and a secondary payload—PowerShell Empire.
Another investigation into Paragon’s Graphite spyware found evidence of a sophisticated iMessage-based zero-click attack against an iPhone. Citizen Lab reported that Apple subsequently confirmed the attack had been mitigated in iOS 18.3.1 and assigned it CVE-2025-43200. | In one 2025 investigation, Citizen Lab forensically examined iPhones belonging to journalists who had received Apple’s notifications and found evidence consistent with Paragon’s Graphite spyware.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We named this malware Graphite due to the use of the Microsoft Graph API to use OneDrive as command and control.
Zraniteľnosť bola podľa analýzy The Citizen Lab zneužitá na inštaláciu špionážneho softvéru Graphite od spoločnosti Paragon. Kompromitované mali byť mobilné zariadenia viacerých novinárov v Európe.
Associated Malware & Tools graphon ... Graphican GoGra remsec_strider BirdyClient Grager graphite
“...only a few exceptions, such as the Graphite malware documented by Trellix in 2021...”
30 distinct techniques documented for this family, organized by ATT&CK tactic.
COPASIR said it verified that to use Paragon’s spyware, an operator has to log in with a username and password, and each deployment of the spyware leaves detailed logs.
In 2023, Citizen Lab documented BLASTPASS, an NSO Group Pegasus exploit chain that targeted iPhones through maliciously crafted iMessage content and was capable of compromising devices without victim interaction.
Multiple entries describe APT28/Pawn Storm/Sofacy campaigns using lure documents, themed emails, and phishing schemes, e.g., “APT28 Hacker Group Targeting Europe, Americas, Asia in Widespread Phishing Scheme”, “New Spear Phishing Campaign Pretends to be EFF”, and “distribution of emails with 'instructions' on 'updating the operating system'”.
Examples include “PowerPoint mouse-over event abused to deliver Graphite implants”, “BREXIT-themed lure document that delivers ZEKAPAB malware”, “fake NATO training docs to breach govt networks”, and repeated references to lure documents delivering Zebrocy or Seduploader.
logs on the device indicated that it made a series of requests to a server that, during the same time period, matched our published Fingerprint P1.
This led to the installation of a second-stage downloader, followed by Graphite and a secondary payload—PowerShell Empire.
A typical high-end mobile exploit chain might begin with a memory-safety or logic flaw in a remotely reachable parser or service. If the vulnerable component processes attacker-controlled data automatically, exploitation may require no visible interaction from the victim.
The Citizen Lab reported “a growing ecosystem of spyware capability” among Ontario police services, after identifying server infrastructure that indicated potential use of Paragon Solutions’ Graphite spyware by the Ontario Provincial Police.
The Citizen Lab reported “a growing ecosystem of spyware capability” among Ontario police services, after identifying server infrastructure that indicated potential use of Paragon Solutions’ Graphite spyware by the Ontario Provincial Police.
due to the fact that Android has limited logs, as well as “efforts by Paragon to delete traces of the infection,” it may be impossible to confirm that.
COPASIR said it verified that to use Paragon’s spyware, an operator has to log in with a username and password, and each deployment of the spyware leaves detailed logs.
The researchers analyzed the unnamed journalist’s devices and found that one of them was infected with Graphite, based on forensic evidence showing that the spyware communicated with a server that the researchers had previously established with “high confidence” was part of Paragon’s infrastructure.
Analysis of the BirdyClient malware (Trojan.BirdyClient) revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it.
Graphite will also query for new commands by enumerating the child files in the 'check' subdirectory.
Adversaries created multiple stages to obfuscate the command-and-control channel and to make detection more difficult.
Repeated malware-delivery chains such as Zebrocy loaders, Seduploader, Downdelph, Cannon, and Graphite imply staged retrieval of additional payloads after initial compromise.
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Spyware from Paragon Solutions, mentioned briefly as another example of spyware attacks against civilian phones. The article provides no details about its infection methods or surveillance capabilities.
Commercial spyware made by Paragon Solutions, reported as used to target approximately 90 WhatsApp users, including journalists, human-rights workers, and other civil-society members.
Commercial spyware platform from Paragon Solutions; the content states that HSI temporarily reactivated its license for it.
Memory-resident DLL used in an espionage campaign active during October–November 2021. Delivered through an infection chain exploiting CVE-2021-40444, it uses Microsoft Graph API requests to exchange commands and results through attacker-controlled OneDrive accounts. It collects system information, compresses and encrypts communications, and executes shellcode tasks that deliver subsequent Empire stages. The article tentatively associates the campaign with APT28, but its attribution statements are inconsistent and do not establish definitive responsibility.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.