Update to the REF2924 intrusion set and related campaigns

Elastic Security Labs analyzes three implants—DOORME (an IIS module backdoor), SIESTAGRAPH (a .NET implant using Microsoft Graph/OneDrive for C2), and a SHADOWPAD loader—linking them to the REF2924 intrusion set and related campaigns attributed to regional/nation-aligned actors (Winnti/ChamelGang). The report includes code-level behavior, obfuscation and persistence techniques, command functionality, observed victim types (including Exchange servers and a foreign ministry), YARA rules, hunting queries, and indicators to aid detection and response.