An active espionage campaign tracked as SHEETCREEP that leverages a UAE‑India diplomatic-themed ISO lure to deliver a compact C# remote access trojan (RAT) and uses Google Sheets as its command-and-control (C2) channel.
The ISO, named UAE-India_Strategic_Partnership_Week.iso, contains a deceptively iconized LNK file that launches a C# dropper.
The dropper extracts a decoy PDF to temp, writes the RAT payload to %LOCALAPPDATA%\Microsoft\Vault\vaultsvc.exe, sets Hidden and System attributes, and establishes persistence via a programmatically created scheduled task named WindowsVaultSyncService.
To remove forensic traces, the dropper self-deletes and moves the benign PDF into the original executable’s path, leaving only the RAT and the scheduled task behind.
The RAT itself is a small .NET assembly that offloads command execution to an embedded PowerShell runspace and relegates all C2 storage to the Google Sheets API v4.
Building on Zscaler ThreatLabz’s initial January 2026 discovery , Securonix’s analysis shows the adversary has evolved the malware to harden evasion and operational resilience while preserving the novel Sheets-as-C2 technique.
On startup it generates a unique victim tab name using username, hostname, and a short SHA256-derived hash; each victim receives a dedicated sheet tab where Column A carries Base64-encoded operator commands and Column B returns Base64-encoded command output.
Authentication to Sheets is performed via an embedded GCP service account identity [email protected] with a bundled RSA‑2048 private key used to mint OAuth2 JWTs.
Access tokens are refreshed proactively to maintain uninterrupted connectivity.
Notable evolutions in this variant include XOR-based obfuscation of C2 configuration strings using the key “discrete,” decrypted at runtime by a JIT() routine.
This replaces earlier plaintext configuration storage and complicates static analysis. The RAT also implements anti-analysis and counter‑forensics: it profiles running processes and open window titles, detects common analyst/debugging tools (dnSpy, Wireshark, Network Monitor), and will forcibly reboot a host via Restart-Computer -Force to disrupt interactive analysis.
For stealthy command execution, the malware runs PowerShell in-process via System.Management.Automation, avoiding a visible powershell.exe child process and making EDR detection more difficult.
Securonix researchers were able to extract the embedded GCP credentials from the binary, authenticate to the live C2 spreadsheet, and enumerate 91 active victim tabs at the time of investigation.
The dataset included automated sandbox check-ins, security research lab VMs, multiple likely true targets, and a high-confidence target located in Islamabad, Pakistan.
Network telemetry shows the RAT communicating with Google API endpoints over TLS to typical Google IP ranges, rendering network-level detection challenging since traffic appears as legitimate Google Workspace API calls.
Attribution analysis, guided by lure theming, delivery mechanics (ISO with LNK), historical patterns, and overlaps with earlier SHEETCREEP reporting, assigns moderate confidence to APT36 (Transparent Tribe) activity an actor known for campaigns targeting Indian diplomatic and government entities.
The campaign’s layered evasions COM-based task registration to avoid command-line logging, hidden placement in a Windows Vault directory, in-memory PowerShell, obfuscated configuration, and cloud‑native C2 underscore the operational maturity of the actors and their responsiveness to public reporting.
Defenders should prioritize endpoint detection rules targeting scheduled tasks created via Task Scheduler COM interfaces, unusual executables within %LOCALAPPDATA%\Microsoft\Vault, in-process PowerShell indicators, and anomalous OAuth2 JWT usage or service-account activity tied to unexpected spreadsheet resources.
Threat hunters can also leverage the disclosed service account identifier and the TTPs detailed by Securonix and Zscaler to telemetry for matching patterns and contain active intrusions.
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.
Microsoft has disclosed a set of critical remote code execution (RCE) vulnerabilities affecting Outlook and…
Palo Alto Networks has released patches for three new PAN-OS vulnerabilities that could allow authenticated…
A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026…
A suspected cyberattack targeting Tchap, the secure messaging platform used by French government agencies, has…
Authorities have dismantled a major cryptocurrency laundering infrastructure known as “AudiA6,” disrupting a critical financial…
Microsoft has disclosed a high-severity information disclosure vulnerability affecting its Teams application for Android, tracked…
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
