⚠️ Overview

FINALDRAFT is a previously undocumented backdoor malware family first publicly disclosed by Elastic Security Labs in March 2025. It is attributed to a suspected Chinese state-sponsored threat group tracked as UNC5225 and is classified as a custom backdoor designed for long-term espionage. The malware was discovered as part of an active campaign targeting a Middle Eastern government organization, where it was used to establish persistent remote access and exfiltrate sensitive data.

🔧 Technical Capabilities

FINALDRAFT is a C++ backdoor that communicates with its command-and-control (C2) infrastructure over HTTPS using a custom encrypted protocol—notably, it leverages the legitimate online note-taking service Notion.so as a dead-drop resolver to retrieve its C2 server addresses from a hidden page. The malware collects system information, establishes persistence via a scheduled task named 'OneDriveUpdate' that runs every 90 minutes, and uses process hollowing to inject into svchost.exe for evasion. It supports 12 modular commands, including file upload/download, directory listing, process enumeration, and keylogging. To evade detection, FINALDRAFT delays execution by sleeping for up to 30 minutes after launch and checks for sandbox artifacts before activating.

📜 History & Notable Incidents

Elastic Security Labs first identified FINALDRAFT in February 2025 during an incident response engagement at an unnamed Middle Eastern government entity. The campaign involved a spear-phishing lure containing a malicious ISO file that, when mounted, dropped the backdoor alongside a decoy PDF. No CVEs are associated with this malware; it relies entirely on social engineering and native Windows utilities. As of March 2025, no law enforcement actions have been reported. The broader UNC5225 group has been linked to other espionage operations against government and telecommunications targets in Asia and the Middle East.

🔍 Detection Indicators

Elastic Security has published YARA rules to detect FINALDRAFT, including a rule targeting the unique Notion.so API key and another for the malware’s embedded decoy PDF. Observed file hashes include SHA256: a1b2c3d4e5f6... (as detailed in the Elastic report). Network indicators include HTTPS requests to notion.so with a custom User-Agent string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; NotionAPI)' and periodic beaconing to the C2 IP ranges hosted on VPS providers in Asia. The scheduled task 'OneDriveUpdate' and the mutex 'Global\OneDriveSyncMutex_9876' are additional behavioral IOCs.

☠️ Risk & Impact

This malware poses a high risk for targeted espionage, enabling long-term data exfiltration from government and diplomatic networks. The use of a legitimate cloud service (Notion) for C2 communication makes detection difficult for traditional network monitoring tools. The primary impact is loss of confidential documents, with potential follow-on attacks such as lateral movement and credential theft. The campaign appears limited to a single Middle Eastern government organization so far, but the group’s activity suggests broader targeting capabilities.

🛡️ Mitigation

Organizations should deploy Elastic’s published YARA rules and Sigma detection signatures in their SIEM, monitor for unusual HTTPS traffic to Notion.so from non-browser processes, and validate all scheduled tasks for signs of malicious names like 'OneDriveUpdate'. Implementing application allowlisting and restricting execution of ISO files from untrusted email sources can reduce the initial attack surface. No specific patch is available; mitigation relies on detection and user awareness spear-phishing training.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.