APT40__2020__Microsoft_Security_detecting_empires_in_the_cloud_-_Microsoft_Security.pdf

# Executive summary Microsoft Threat Intelligence Center (MSTIC) describes GADOLINIUM, a nation-state activity group that has targeted maritime, health, education and government organizations since 2016 and has evolved from bespoke malware to abusing cloud services and open-source toolkits (TechNet, GitHub, OneDrive/Graph API, Outlook Tasks) to deliver payloads, run C2 and obfuscate activity; the report documents attack chains (VBA droppers, PowerShell Empire, LazyCat, web shells), detection examples, IOCs (hashes, attacker emails, Azure AD app IDs), and Microsoft’s proactive mitigation actions including suspending malicious Azure AD applications.