Revoking the token didn’t kill the backdoor

An implant was reverse-engineered that uses a real OneDrive account for Command and Control (C2) to remotely replace stolen credentials. Incident response procedures should prioritize immediate token revocation, password resets, session kills, and refresh token invalidation as the first step in any identity compromise response. The C2 channel is established over standard Microsoft infrastructure, leveraging TLS communication over graph.microsoft.com without using unusual domains or ports.
The implant communicates through a mechanism where an operator encrypts tasks into a job folder on a OneDrive account, which the implant polls to execute commands and uploads results. This communication leverages legitimate cloud services, avoiding typical network-layer detection methods. Furthermore, the implant identifies victims not by network characteristics but by hashing hardware identifiers (network adapter MAC address, CPU, disk serial numbers) via WMI, meaning endpoint relocation does not change the implant's identification.
The critical vulnerability lies in a specific command within the implant: an 'upgrade' function that allows the handler to destroy five existing credential strings, copy five new ones, and swap the live API instance with a configuration pointing to a second OneDrive account. This demonstrates that simple token revocation is insufficient because the adversary can maintain persistence by swapping the identity behind the revoked tokens without altering endpoint artifacts.

* The implant uses a real OneDrive account for C2.
* Revocation of credentials is not containment.
* Incident response runbooks must include revoking tokens, resetting passwords, killing sessions, and invalidating refresh tokens before hunting.
* The C2 channel authenticates to Microsoft Graph as an OAuth application using a OneDrive account.
* Tasking involves the operator writing an encrypted task file into a job folder, which the implant polls for execution and uploads results.
* Communication occurs over graph.microsoft.com over TLS.
* The implant identifies victims by hashing hardware addresses with CPU and disk serial numbers via WMI.
* An 'upgrade' command allows the implant to destroy existing credential strings, copy new ones, rebuild OAuth scope structures, and swap the live API instance.
* The application registration details (client ID, client secret, tenant ID, refresh token) are present in cleartext within the binary.

The observed behavior reveals a fundamental asymmetry: credential rotation does not equal access removal when C2 leverages application identity residing on a cloud platform. Revocation acts as a delay rather than an eviction because the adversary can queue follow-up actions against another registered account, demonstrating that the registration process is the root object, not the ephemeral tokens it issues. This implies that containment must shift from securing the endpoint to controlling the application registration itself within the identity tenant.
The pattern of cloud-hosted C2, where artifacts are hosted in a shared cloud environment, shifts detection focus away from traditional network signatures toward analyzing cloud telemetry—specifically monitoring sign-in events, authentication against unfamiliar tenants, and file telemetry related to specific user agents or beacon files. The adversary's ability to swap identities cheaply forces an investigation into the identity plane, treating the application registration as the primary target rather than just endpoint remediation.
This dynamic suggests a shift in adversarial focus from infrastructure control to identity entitlement. If adversaries can leverage dormant cloud resources for persistence, and if detection methods remain rooted in traditional network analysis, operators are left chasing artifacts that the attacker has no incentive to change—the code on the endpoint and the resulting telemetry data. The implication is that true containment requires disrupting the application's root registration within the cloud environment, rather than simply managing session tokens.
Bridge Questions: If identity rotation costs an attacker only a response cycle, how should incident response prioritize actions between endpoint isolation and cloud identity suspension? What new metrics must be introduced to measure the risk associated with specific application registrations within a tenant? How can organizations move detection capabilities to effectively interrogate application registration events rather than solely focusing on network egress?