Looking Over the Nation-State Actors’ Shoulders

Analysis of Operation Graphite, a multi-stage espionage campaign targeting high-ranking government officials overseeing national security policy and individuals in the defense industry in Western Asia. Nation-state operator using OneDrive as a Command and Control (C2) server. Timestamps of the actor’s activity were based on forensic artifacts. Registration of C2 domains. Use of OneDrive to sync encrypted command files with victims. Setup script for C2 server accidentally synchronized and observed. Investigation of Empire server logs to identify victims and understand how threat actors operated. Testing the connectivity to the C2 and executing reconnaissance commands.