Update to the REF2924 intrusion set and related campaigns

Key takeaways DOORME is a malicious IIS module that provides remote access to a contested network. SIESTAGRAPH interacts with Microsoft’s GraphAPI for command and control using Outlook and OneDrive. SHADOWPAD is a backdoor that has been used in multiple campaigns attributed to a regional threat group with non-monetary motivations. REF2924 analytic... Weiterlesen