Loading story…
Researchers at Elastic Security Labs have identified a new Windows backdoor named NANOREMOTE, which leverages the Google Drive API for command-and-control (C2) operations. The malware shares code similarities with the FINALDRAFT (Squidoor) implant, previously linked to the threat group REF7707, and is capable of data exfiltration and payload staging through Google Drive, making detection challenging. The attack chain involves a loader, WMLOADER, which masquerades as a Bitdefender executable and decrypts shellcode to load NANOREMOTE into memory, with similar loaders mimicking other security products.
NANOREMOTE is a 64-bit C++ backdoor that supports 22 command handlers, enabling attackers to execute commands, move files, and gather system information on compromised Windows systems. The malware communicates with a hard-coded, non-routable IP address over HTTP, using encrypted and compressed JSON payloads. The threat actor REF7707, suspected to be a Chinese group, has previously targeted sectors such as government, defense, telecommunications, education, and aviation, with recent activity including a prolonged intrusion at a Russian IT service provider. The initial access vector for NANOREMOTE remains unknown.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic disclosed that NANOREMOTE uses the Google Drive API for command-and-control, file transfer, and stealthy data exfiltration on Windows systems, with WMLOADER used to launch the backdoor and 22 command handlers supporting system control.
Elastic Security Labs discovered a new Windows backdoor called NANOREMOTE and found code similarities, shared cryptographic material, and development overlap with the FINALDRAFT (Squidoor) malware associated with REF7707.
Elastic said the REF7707 threat cluster, suspected to be a Chinese threat group, has targeted government, defense, telecommunications, education, and aviation organizations in Southeast Asia and South America since at least March 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs linked the **REF7707** cyberespionage activity to a modular malware ecosystem targeting a South American foreign ministry and likely victims in Southeast Asia. The operators used valid credentials and Windows administrative functionality to deploy the PATHLOADER and GUIDLOADER loaders, including a renamed `cdb.exe` Microsoft debugger to execute in-memory shellcode. PATHLOADER retrieved encrypted payloads from typosquatted and attacker-controlled infrastructure before launching **FINALDRAFT**, a Windows and Linux remote-access tool that used Microsoft Graph API access to communicate through Outlook draft messages. FINALDRAFT supports collection and exfiltration, process injection, proxying, file operations, network discovery, in-memory PowerShell with AMSI/ETW bypasses, and Pass-the-Hash activity; samples spanning 2023 and 2024 indicate sustained development. Elastic later identified **NANOREMOTE** and its WMLOADER delivery component as likely related to the same cluster: WMLOADER masquerades as security software, decrypts `wmsetup.log` with AES-CBC, and executes the backdoor in memory, while NANOREMOTE uses the Google Drive API for command-and-control, payload staging, and bidirectional file transfer. Shared loader behavior, cryptographic material, filenames, code, and network traits indicate a common development environment or codebase.
Sep 9, 2026
Threat actors increasingly used small, heavily obfuscated droppers to retrieve encrypted malware payloads from trusted cloud storage platforms including **Google Drive**, **OneDrive**, **Dropbox**, and **SharePoint**, then decrypt and execute them only in memory. Check Point Research linked the technique to Legion Loader and multiple other malware families such as **NanoCore**, **LokiBot**, **Remcos**, and **Pony Stealer**, identifying roughly **10,000 samples** and about **800 new samples per week**; **Google Drive** accounted for **72%** of observed payload downloads. The droppers were commonly distributed through spam campaigns carrying **ISO attachments** and used anti-debugging, sandbox evasion, and optional registry autorun persistence to delay payload retrieval until after reboot. Researchers said the downloaded files were typically stored in encrypted form using rotating-XOR with long hardcoded keys, often with names containing `_encrypted_`, and were never written to disk in decrypted form, making retrospective forensic analysis more difficult even as well-instrumented sandboxes could still reveal the full infection chain.
Aug 14, 2026
A previously undocumented .NET-based malware, dubbed CAPI Backdoor, has been identified as the payload in a targeted phishing campaign against Russian automotive and e-commerce companies. The attack begins with spear-phishing emails containing a ZIP archive, which was first observed on VirusTotal on October 3, 2025. This ZIP file includes a Russian-language decoy document, purporting to be a notification about income tax legislation or payroll recalculation, and a malicious Windows shortcut (LNK) file. The LNK file, named identically to the ZIP archive, is engineered to execute the CAPI Backdoor DLL (adobe.dll) using the legitimate Windows binary rundll32.exe, a classic living-off-the-land (LotL) technique that helps evade detection. Once executed, the backdoor checks for administrator privileges, enumerates installed antivirus products, and opens the decoy document to distract the user while it operates covertly. The malware establishes persistence by creating a scheduled task and placing a shortcut in the Windows Startup folder, ensuring it runs on system reboot. CAPI Backdoor connects to a remote command-and-control server at 91.223.75[.]96, from which it can receive further instructions. Its capabilities include stealing data from popular web browsers such as Chrome, Edge, and Firefox, taking screenshots, collecting detailed system information, and enumerating folder contents for exfiltration. The malware also performs extensive checks to determine if it is running in a virtual machine or sandbox environment, likely as an anti-analysis measure. Infrastructure analysis revealed that one of the domains used in the campaign is linked to the Russian automotive sector, supporting the assessment that this industry is a primary target. The campaign also impacts the broader e-commerce sector within Russia, as indicated by the targeting patterns and decoy content. Seqrite Labs, which conducted the technical analysis, has provided indicators of compromise (IOCs) and mapped the attack to relevant MITRE ATT&CK techniques. The campaign demonstrates a sophisticated use of social engineering, leveraging localized decoy documents and legitimate system binaries to maximize infection success and persistence. The use of a previously unknown .NET implant highlights the evolving tactics of threat actors targeting Russian commercial sectors. Organizations in the affected industries are advised to update their security controls, educate employees about phishing risks, and monitor for the provided IOCs. The discovery underscores the ongoing threat posed by targeted phishing campaigns leveraging custom malware and advanced evasion techniques.
Jun 29, 2026