This week's tradecraft converged on hiding command-and-control inside trusted services and native tooling — Graph-API calendars, DNS, the Telegram API, a browser the malware never connects through, and BitLocker instead of a ransomware binary
Six unrelated pieces of 2026-W30 research, read together, describe one defensive problem more usefully than any single sample: attackers are increasingly routing both command-and-control and impact through infrastructure and tooling defenders already trust, so detection that keys on process reputation or destination novelty is blind to it. This extends the prior weekly's state-nexus "blinding the defender's own visibility" theme from EDR-evasion into a broader pattern — the trusted carrier is the point.
On the C2 side, the convergence is striking. Group-IB's HOLLOWGRAPH never contacts attacker infrastructure directly: it plants and reads tasking as attachments on far-future Microsoft 365 calendar events via the Graph API, and Kaspersky independently corroborated the same Cavern framework, adding a resilience layer in which — when Microsoft Graph authentication or tenant validation fails — the module recovers replacement connection settings (TenantId, ClientId, ClientSecret, UserEmail) via DNS AAAA responses from attacker nameservers (Kaspersky, 2026-07-21). Cisco Talos's msaRAT goes further and removes the socket from the malware entirely — "This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API" (Cisco Talos, 2026-07-23), driving a headless browser to tunnel over a WebRTC DataChannel relayed via a Twilio TURN server (with Cloudflare Workers handling the signalling), so endpoint tooling that asks "which process opened the connection" sees only the browser. Zscaler's TELESHIM, used against Middle-East government targets, "abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic" (Zscaler ThreatLabz, 2026-07-20).
The same "use what is trusted" logic runs through the endpoint and impact layers. Proofpoint's Cruciferra crypter-as-a-service — used by the China-nexus actor TA4922 to deliver AsyncRAT — combines a process-ghosting loader with BYOVD EDR termination and indirect syscalls issued from a clean on-disk copy of ntdll.dll, defeating user-mode hooks that monitor the loaded copy (Proofpoint, 2026-07-20). And Kaspersky's "XEntry" extortion cases skipped a bespoke ransomware family entirely, entering via internet-exposed RDP and a misconfigured SQL Server and then using legitimate RMM tooling and a Group Policy Object to deploy native BitLocker for encryption-for-impact (Kaspersky, 2026-07-21) — an impact stage with no malware artifact to signature at all.
This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API.
TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.
ATT&CK mapping
7 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Privilege Escalation TA0004
T1055.012Process Injection: Process Hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
Stealth TA0005
T1055.012Process Injection: Process Hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1071.004Application Layer Protocol: DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1090Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
T1102.002Web Service: Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Impact TA0040
T1486Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.