A RAT in the spreadsheet. [Research Saturday]

Today we are joined by Aaron Beardslee (linkedin.com/in/aaron-beardslee), Manager of Threat Research at Securonix (linkedin.com/company/securonix), discussing "Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation." Securonix researchers have identified an evolved version of the SHEETCREEP espionage campaign, using a diplomatic-themed ISO phishing lure to deliver a C# remote access trojan targeting Indian diplomatic interests.

The malware abuses the Google Sheets API as a stealthy command-and-control channel, with researchers identifying 91 active victim tabs, including a high-confidence target in Pakistan. The campaign, assessed with moderate confidence as linked to Pakistan-aligned APT36, has added XOR-obfuscated configurations and other anti-analysis techniques to evade detection and maintain persistent access.

The research and executive brief can be found here:

• ⁠ (lumen.com/blog/en-us/expanded-jdy-iot-and-soho…)Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation (chatgpt.com/c/6a874ceb-cd40-83ea-a1b5-fb1d570d…)

Learn more about your ad choices. Visit megaphone.fm/adchoices