APT / THREAT GROUP

Graphite

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Trellix describes Graphite as a malware using the Microsoft Graph API and OneDrive for C&C. It was found being deployed in-memory only and served as a downloader for Empire.

Threat Analysis

Graphite is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf

→https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.graphiteGraphite

External Intelligence

Malpedia: win.graphite

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Graphite