FINALDRAFT
FINALDRAFT is a modular remote administration backdoor/implant associated with the REF7707 threat cluster, also tracked as Jewelbug, Ink Dragon, CL-STA-0049, and Earth Alux. It has been described as a full-featured espionage-oriented tool used against government and telecommunications targets in South America, Southeast Asia, Europe, Asia, and Africa, and is capable of infecting both Windows and Linux systems.
The malware was reported as a 64-bit C++ implant focused on data exfiltration and process injection, with support for add-on or injected modules that extend functionality. Reported capabilities include file manipulation, host discovery, internal traffic proxying, covert network tunneling, PowerShell execution, process injection, and command execution. FINALDRAFT implements a large command set and can inject into existing or newly created hidden processes, with observed defaults including mspaint.exe and conhost.exe. Associated modules identified in reporting include components for network enumeration, in-memory PowerShell execution with AMSI/ETW bypass, and a Pass-the-Hash toolkit inspired by Mimikatz.
A defining feature of contemporary FINALDRAFT variants is command-and-control via Microsoft cloud services. Multiple reports state that FINALDRAFT abuses Microsoft Graph API and Outlook draft messages for C2, allowing traffic to blend with legitimate Office 365 or Microsoft cloud activity. Reported behavior includes obtaining OAuth tokens from Microsoft using refresh tokens stored in configuration, storing refreshed tokens in the Windows Registry, creating session draft emails, polling for command drafts, deleting commands after execution, and posting responses back as drafts. Newer variants were also reported to hide command traffic inside mailbox drafts, intercept OAuth tokens, check in during business hours to reduce suspicion, and transfer large files more efficiently with minimal noise. A Linux ELF variant was also identified with broader transport options including HTTP/HTTPS, reverse UDP, ICMP, bind/reverse TCP, DNS, and Outlook via REST/Graph API.
FINALDRAFT has been observed delivered by loader malware including PATHLOADER, which downloads AES-encrypted, Base64-encoded shellcode from attacker infrastructure and executes it in memory, and in some intrusions via a renamed Microsoft-signed CDB.exe used to load shellcode from a weaponized INI file and inject into mspaint.exe. Persistence observed alongside FINALDRAFT included a scheduled task named \Microsoft\Windows\AppID\EPolicyManager running every minute as SYSTEM. Related infrastructure and observables mentioned in reporting include graph.microsoft[.]com, login.microsoftonline[.]com, support.vmphere[.]com, update.hobiter[.]com, poster.checkponit[.]com, support.fortineat[.]com, ictnsc[.]com, hobiter[.]com, vmphere[.]com, fortineat[.]com, and checkponit[.]com. Reported sample hashes associated with FINALDRAFT activity include 6d79dfb00da88bb20770ffad636c884bad515def4f8e97e9a9d61473297617e3 for an in-memory FINALDRAFT shellcode sample.
FINALDRAFT is also referred to as Squidoor in the provided content, and multiple sources describe code and behavioral overlap between FINALDRAFT and NANOREMOTE, suggesting a shared development lineage or common author.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The intrusion set utilized by REF7707 includes novel malware families we refer to as FINALDRAFT, GUIDLOADER, and PATHLOADER.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
Then fontdrvhost.exe spawned mspaint.exe and injected shellcode into it.
Both PATHLOADER and GUIDLOADER are used to download and execute encrypted shellcodes in memory.
Command and Control
6 techniques
Command and Control
the most notable are the means we observed in our victim environment, abuse of Microsoft’s Graph API.
Once the initial execution and check-in have been completed, all further communication proceeds through legitimate Microsoft infrastructure (graph.microsoft[.]com).
It also supports relay functionality that enables it to proxy traffic for other infected systems.
FINALDRAFT uses legitimate services such as MS Graph to act as command-and-control servers (C2s)... NetDraft relies on the MS Graph API to communicate with its OneDrive based C2... CloudSorcerer v3 will contact GitHub to obtain C2 information... or read a GameSpot profile
IOCs tracked for this family
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Implant/backdoor that uses Microsoft Graph API for C2; referenced as similar to NANOREMOTE.
Bespoke malware providing remote access; uses Microsoft Graph API for C2/operations; used for espionage against a South American foreign ministry and other entities.
Backdoor used for data exfiltration and lateral movement in victim environments.
Malware used in targeted attacks against government and telecom entities, specific functionality not detailed in the content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.