NANOREMOTE

NANOREMOTE is a fully featured Windows backdoor first reported by Elastic Security Labs in October 2025. It is described as a 64-bit Windows implant written in C/C++ that uses the Google Drive API as a primary command-and-control and file-transfer channel, allowing attacker traffic to blend with legitimate encrypted Google API activity for stealthy data exfiltration and payload staging. Elastic and other reporting state that NANOREMOTE shares significant code and behavioral overlap with the FINALDRAFT implant (also known as Squidoor) and is likely linked to the REF7707 threat cluster, also referenced as Jewelbug, Ink Dragon, CL-STA-0049, and Earth Alux; Check Point described it as part of that actor’s malware arsenal, although it did not observe NANOREMOTE directly in its own intrusions.

Observed delivery involves a loader named WMLOADER, which masquerades as Bitdefender’s BDReinit.exe and has been reported in similar forms impersonating security software. WMLOADER decrypts a payload file named wmsetup.log using AES-CBC and executes NANOREMOTE in memory, reducing on-disk artifacts. Reported technical details include shellcode decryption, use of VirtualAlloc and VirtualProtect, and a hard-coded 16-byte ASCII AES key of 3A5AD78097D944AC for wmsetup.log decryption. Elastic also reported a wmsetup.log sample uploaded from the Philippines on 2025-10-03 that decrypted to a FINALDRAFT implant, reinforcing the shared development lineage.

NANOREMOTE communicates over HTTP POST to /api/client with the User-Agent NanoRemote/1.0 and uses Zlib-compressed, AES-CBC-encrypted JSON payloads; one reported sample used a hard-coded non-routable IP address. The malware can also accept Google Drive credentials through a pipe-separated configuration string or the NR_GOOGLE_ACCOUNTS environment variable, and uses hard-coded OAuth 2.0 material including client IDs and refresh tokens. It polls Google Drive for queued tasks and parses JSON responses to execute operator instructions.

The backdoor implements 22 command handlers covering host discovery, directory and file operations, command execution, payload execution, and Google Drive transfer management. Reported functions include collecting host information such as IP addresses, username, hostname, admin-group membership, process path, OS build and product name, and process ID; queuing Google Drive downloads and uploads; pausing, resuming, and canceling transfers; spawning processes and returning output through pipes; executing PE files from disk via a custom loader derived from libPeConv; and loading Base64-encoded PE payloads directly in memory. Additional reported behaviors include generating a victim identifier by hashing a CoCreateGuid-generated GUID with FNV, creating a Log directory and writing pe_exe_run.log, and installing a crash handler that creates a full-memory minidump on unhandled exceptions.

For evasion and execution control, NANOREMOTE uses Microsoft Detours to hook termination-related functions including GetStdHandle, RtlExitUserThread, RtlExitUserProcess, FatalExit, and ExitProcess. Reporting also notes in-memory execution, custom PE loading, and use of legitimate cloud infrastructure as key factors that complicate network and forensic detection. Targeting associated with the linked REF7707 ecosystem has included government, defense, telecommunications, education, and aviation organizations in Southeast Asia, South America, and, in later reporting, Europe and Africa, but the specific initial access vector for NANOREMOTE itself was reported as unknown.