Graphshell

GraphShell is a malicious software (malware) that has been used in cyber-attacks to exploit and damage computer systems. It was first reported in March 2023 by the cybersecurity firm Bad Magic, which documented its use in attacks targeting Russian-occupied territories of Ukraine. The malware, also known as DBoxShell or PowerMagic, is part of a modular framework called CommonMagic, and it can infiltrate systems through suspicious downloads, emails, or websites. Once inside a system, GraphShell has the capability to steal personal information, disrupt operations, or even hold data for ransom. The reconnaissance phase of GraphShell begins immediately after it is executed, allowing it to quickly start gathering information about the infected system. This makes it highly effective at achieving its destructive goals. In the fifth operation conducted by Bad Magic, they notably switched from using DBoxShell to GraphShell. This alternative malware is named for its use of the Microsoft Graph API, a tool used for building applications that access Microsoft cloud services. The use of GraphShell marks a significant evolution in the tactics of the Bad Magic group. By exploiting the Microsoft Graph API, this malware can leverage Microsoft's cloud services for command and control (C&C) purposes. This allows the attackers to remotely control infected systems, further increasing the potential harm they can cause. As such, the emergence of GraphShell represents a significant escalation in the cyber threat landscape.