Hackers Use UAE

Gbhackers •Mayura Kathir • June 12, 2026

An active espionage campaign tracked as SHEETCREEP that leverages a UAE‑India diplomatic-themed ISO lure to deliver a compact C# remote access trojan (RAT) and uses Google Sheets as its command-and-control (C2) channel. The ISO, named UAE-India_Strategic_Partnership_Week.iso, contains a deceptively iconized LNK file that launches a C# dropper. The dropper extracts a decoy PDF to temp, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SHEETCREEP Espionage Campaign Uses UAE-India Lure for RAT Deployment The SHEETCREEP espionage campaign employs a UAE-India diplomatic-themed ISO file to deliver a C# remote access trojan (RAT) via Google Sheets as its command-and-control channel. The ISO file, named UAE-India_Strategic_Partnership_Week.iso, contains a LNK file that launches a dropper, which extracts a decoy PDF and installs the RAT in a hidden location. The RAT utilizes Google Sheets API for command execution, creating unique tabs for each victim. Researchers identified 91 active victim tabs, including targets in Islamabad, Pakistan. The malware has evolved to include anti-analysis techniques and obfuscation methods to evade detection. Network telemetry shows communication with Google API endpoints, complicating detection efforts. The campaign highlights a significant threat to organizations in the region and beyond. 4 sources 76

Extracted Entities

Hackers Use UAE

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

MITRE ATT&CK (1)

Tools (1)