graphican

Graphican is a novel malware developed by the Chinese threat actor group known as Flea, APT15, or Nickel. The malware, an evolution of the group's custom backdoor Ketrican, has been used in a series of cyber-attacks against foreign affairs ministries across Central and South America between late 2022 and early 2023. Unlike its predecessor, Graphican leverages the Microsoft Graph API and OneDrive to establish its command-and-control (C&C) infrastructure, a technique also employed by other threat groups such as APT28 and Bad Magic. The Graphican backdoor maintains the same core functionality as Ketrican, but its exploitation of Microsoft's services for C&C server details represents a significant upgrade. This malware can perform various operations based on commands received from the C&C server, including creating an interactive command line, generating files, downloading files, and creating processes with hidden windows. Its deployment signifies a continued trend of state-sponsored cyber threats aimed at infiltrating and disrupting foreign governmental operations. The discovery and analysis of the Graphican malware were detailed by the Threat Hunter Team at Symantec. This revelation underscores the persistent threat posed by state-sponsored actors like Flea, who have demonstrated their ability to evolve their techniques and tools over time. As a result, ongoing vigilance and proactive cybersecurity measures remain critical in countering such sophisticated threats.