SHEETCREEP

Its phishing lures have impersonated network and logistics tools used by a large Afghani telecommunications company, a fuel-conservation tool for India's energy sector, an Indian government employee benefits resource, and so on.

Its phishing lures have impersonated network and logistics tools used by a large Afghani telecommunications company, a fuel-conservation tool for India's energy sector, an Indian government employee benefits resource, and so on.

For persistence, it installs a scheduled task named WindowsVaultSyncService with a misleading description crafted to appear harmless during manual review. The task runs at every user login with no time limit, keeping attacker access alive indefinitely.

Instead of launching PowerShell as a separate program, the RAT executes commands entirely from within its own process memory, leaving no child process visible to security monitoring tools.

Victims receive an ISO file, and inside it is a shortcut that looks like a PDF but quietly launches the malicious dropper when double-clicked.

For persistence, it installs a scheduled task named WindowsVaultSyncService with a misleading description crafted to appear harmless during manual review. The task runs at every user login with no time limit, keeping attacker access alive indefinitely.

For persistence, it installs a scheduled task named WindowsVaultSyncService with a misleading description crafted to appear harmless during manual review. The task runs at every user login with no time limit, keeping attacker access alive indefinitely.

Threat actors have upgraded their tools to make detection harder, replacing plaintext configuration settings with XOR-encrypted strings decoded only at runtime.

Victims receive an ISO file, and inside it is a shortcut that looks like a PDF... The malware also hides its executable using Hidden and System file attributes inside a directory path that closely resembles a standard Windows system folder.

Mutex Global\WinSync_<username>-<hostname>-<4char-hash> Mutex used by the RAT to enforce single-instance execution

Among the active victim tabs, the team identified 17 potential real targets with physical hardware and no sandbox indicators.

If the malware detects active analysis tools such as dnSpy or Wireshark, it forces an immediate system restart to disrupt any ongoing investigation.

The malware also hides its executable using Hidden and System file attributes inside a directory path that closely resembles a standard Windows system folder.

Among the active victim tabs, the team identified 17 potential real targets with physical hardware and no sandbox indicators.

If the malware detects active analysis tools such as dnSpy or Wireshark, it forces an immediate system restart to disrupt any ongoing investigation.

The threat actor has been stealing data from his desktop and looking into his WhatsApp and private data

Использование Web Protocols через HTTPS к Google Sheets и Firebase; GOSHELL использует HTTP/S, а C2 применяет Google Sheets, Firebase и приватные GitHub-репозитории.

C2-инфраструктура эксплуатирует легитимные облачные сервисы: Google Sheets, Firebase и приватные GitHub-репозитории; также упомянуты Slack, Discord и Supabase.

SheetCreep... converts a Google Drive spreadsheet into a live control hub, polling it for encrypted instructions and writing encrypted responses back into cells.

The threat actor has been stealing data from his desktop and looking into his WhatsApp and private data. They're trying to use that data to [design] decoy Excel files, or something like it, to phish some more employees.

Commands are written into one spreadsheet column and responses go into another, with all data encoded in Base64.

If the malware detects active analysis tools such as dnSpy or Wireshark, it forces an immediate system restart to disrupt any ongoing investigation.