TF-MAL-elf.finaldraft

Description

ThreatFox malware family `elf.finaldraft`. Printable name: FINALDRAFT.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• FINALDRAFT Malware Exploits Outlook for Communication
  web:advisory.eventussecurity.com

  Researchers identified a previously unknown malware family that utilizes Outlook as a communication channel via the Microsoft Graph API. This post-exploitation framework includes a loader, a backdoor, and several modules designed for advanced intrusion activities.

  2026-05-23 22:36 UTC
• CIRT.GY | FinalDraft Malware Abuses Outlook for Stealthy Co
  web:cirt.gy

  A newly discovered malware , FinalDraft , has been leveraging Outlook email drafts for stealthy command-and-control (C2) communication. The malware was uncovered by Elastic Security Labs during an investigation into cyber-espionage attacks against a South American foreign ministry.

  2026-05-23 22:36 UTC
• REF7707 Cybercriminals Exploit FINALDRAFT Malware to Attack Windows ...
  web:cyberpress.org

  This operation leverages a novel malware family , FINALDRAFT , targeting both Windows and Linux systems. The campaign has been linked to attacks on a South American foreign ministry and entities in Southeast Asia, showcasing the group's technical capabilities and operational missteps.

  2026-05-23 22:36 UTC
• New FinalDraft Malware Exploits Microsoft Outlook Drafts For Stealthy ...
  web:cybersecurefox.com

  Security researchers at Elastic Security Labs have uncovered a sophisticated new malware family dubbed FinalDraft , which employs an innovative technique to conceal its command-and-control (C2) communications through Microsoft Outlook draft folders.

  2026-05-23 22:36 UTC
• New Malware Exploiting Outlook As a Communication Channel via The ...
  web:cybersecuritynews.com

  A new family of malware has been discovered that leverages Microsoft Outlook as a communication channel via the Microsoft Graph API. This sophisticated malware includes a custom loader and backdoor, known as PATHLOADER and FINALDRAFT , respectively.

  2026-05-23 22:36 UTC
• FinalDraft Malware Uses Outlook Drafts for Covert Cyber Espionage
  web:dailysecurityreview.com

  FinalDraft malware uses Outlook email drafts for covert command-and-control communication, enabling data exfiltration, process injection, and lateral movement with minimal traces. The malware , part of the REF7707 cyber espionage campaign, targets high-value institutions.

  2026-05-23 22:36 UTC
• FINALDRAFT (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the FINALDRAFT malware family including references, samples and yara signatures.

  2026-05-23 22:36 UTC
• FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on ...
  web:thehackernews.com

  REF7707 deployed FINALDRAFT malware , using Microsoft Graph API for stealthy command-and-control in a global espionage campaign.

  2026-05-23 22:36 UTC
• New FinalDraft malware abuses Outlook mail service for stealthy comms
  web:www.bleepingcomputer.com

  A new malware called FinalDraft has been using Outlook email drafts for command-and-control communication in attacks against a ministry in a South American country.

  2026-05-23 22:36 UTC
• You've Got Malware: FINALDRAFT Hides in Your Drafts - Elastic
  web:www.elastic.co

  You've Got Malware : FINALDRAFT Hides in Your Drafts During a recent investigation (REF7707), Elastic Security Labs discovered new malware targeting a foreign ministry. The malware includes a custom loader and backdoor with many features including using Microsoft's Graph API for C2 communications.

  2026-05-23 22:36 UTC

Only Available for Registered Users. Sign in to view.