Sheetcreep C# RAT Targets Diplomatic Orgs, Abuses Google Sheets API for C2

Key Takeaways

• A novel C# remote access trojan (RAT) named SHEETCREEP is actively targeting diplomatic organizations.
• The malware leverages the Google Sheets API for covert command-and-control (C2) communications, making detection difficult.
• The campaign utilizes sophisticated social engineering, delivering an ISO file disguised as an official document about the “UAE-India Strategic Partnership Week.”
• Researchers attribute the attacks with moderate confidence to APT36 (Transparent Tribe), a Pakistan-aligned threat group.
• Victims have been identified, including a high-confidence target in Islamabad, Pakistan.

SHEETCREEP: A New C# RAT Exploiting Google Sheets for C2

Cybersecurity researchers have uncovered SHEETCREEP, an advanced C# remote access trojan (RAT) that establishes a clandestine command-and-control (C2) channel by exploiting the Google Sheets API. This innovative approach allows threat actors to manage compromised systems with a high degree of stealth, blending malicious network traffic with legitimate Google Workspace activity.

The malware specifically targets diplomatic organizations, employing a meticulously crafted social engineering scheme to entice victims into executing the malicious payload. This campaign represents a strategic effort by attackers to camouflage their operations within the trusted infrastructure of widely used internet platforms.

Initial Infection Vector and Social Engineering

The infection chain begins with a phishing email, carefully designed to appear as an official communication regarding the “UAE-India Strategic Partnership Week.” This email delivers an ISO file, which, when accessed, contains a shortcut disguised as a PDF document. Upon double-clicking this seemingly innocuous shortcut, the malicious dropper is silently launched.

This method of social engineering is highly effective because it exploits the inherent trust individuals place in official-looking government communications. The illusion of legitimacy significantly increases the likelihood of successful execution by unsuspecting targets.

Detailed analysis of this ongoing espionage campaign was conducted by Securonix researchers, who published a comprehensive report. The Securonix team managed to extract hardcoded credentials from the RAT’s binary, enabling them to authenticate directly to the live C2 spreadsheet. This access revealed 91 active victim tabs at the time of their analysis.

Evolution of the Threat and Attribution

While the SHEETCREEP campaign was initially documented by Zscaler ThreatLabz in January 2026, the current iteration demonstrates significant advancements. Threat actors have refined their tools to enhance evasion capabilities, notably replacing plaintext configuration settings with XOR-encrypted strings that are only decoded during runtime. This modification substantially complicates static analysis efforts by security teams.

Security analysts have attributed the campaign with moderate confidence to APT36, also known as Transparent Tribe. This Pakistan-aligned advanced persistent threat (APT) group has a well-documented history of targeting governmental and military entities, particularly within India.

Among the active victim tabs identified, Securonix pinpointed 17 potential real targets exhibiting characteristics of physical hardware and lacking typical sandbox indicators. A high-confidence target was confirmed in Islamabad, Pakistan, underscoring the malware’s successful infiltration into sensitive networks.

SHEETCREEP C# RAT Abuses Google Sheets API as C2

The SHEETCREEP RAT payload, named vaultsvc.exe, is strategically placed within the legitimate Windows Credential Vault folder. This C# malware is remarkably lightweight, weighing approximately 20 KB. Despite its minimal footprint, it possesses full capabilities for command execution, data exfiltration, and reporting back to its operators, all through Google’s ubiquitous spreadsheet infrastructure.

To identify each compromised host, the RAT generates a unique victim identifier derived from the user’s username, machine name, and a four-character hash. This identifier is then used to name a dedicated tab within the attacker’s Google Sheet, establishing a personalized communication channel for each victim.

All communications between the RAT and its C2 infrastructure occur via the Google Sheets API over HTTPS. This design choice makes the malicious traffic indistinguishable from ordinary Google Workspace activity, severely hindering traditional network-based detection methods. Commands are written into one column of the spreadsheet, and the RAT’s responses are recorded in another, with all data Base64 encoded. Crucially, C2 configuration strings, including the spreadsheet ID and the service account email, are XOR-encrypted using the key “discrete,” only being decrypted at runtime to further impede analysis.

Evasion Techniques and Persistence Mechanisms

SHEETCREEP incorporates sophisticated evasion techniques to avoid detection. Rather than spawning a separate PowerShell process, the RAT executes commands entirely within its own process memory. This in-process execution prevents the creation of child processes that security monitoring tools would typically flag, effectively bypassing common behavioral detection heuristics.

The malware also employs file system camouflage, hiding its executable using Hidden and System file attributes. It places itself within a directory path that closely mimics a standard Windows system folder, further obscuring its presence from casual inspection.

For persistence, SHEETCREEP establishes a scheduled task named WindowsVaultSyncService. This task is given a benign-sounding description to evade suspicion during manual reviews and is configured to run at every user login without a time limit, ensuring continuous access for the attackers. Furthermore, the RAT includes an anti-analysis mechanism: if it detects the presence of common analysis tools like dnSpy or Wireshark, it initiates an immediate system restart, disrupting any ongoing forensic investigation.

What You Should Do

• Exercise Caution with Attachments: Strictly avoid opening unsolicited ISO file attachments, especially those from unknown or unverified senders, even if they appear to be official documents.
• Monitor Windows Vault Directory: Implement monitoring for unexpected executables appearing within the %LOCALAPPDATA%MicrosoftVault directory path.
• Scrutinize Scheduled Tasks: Pay close attention to scheduled tasks registered through COM interfaces rather than standard command-line methods, and investigate any tasks with suspicious names or descriptions.
• Monitor Google Sheets API Connections: Flag and investigate any non-browser processes making repeated connections to Google Sheets API endpoints (e.g., sheets.googleapis.com, oauth2.googleapis.com).
• Enhance Endpoint Logging: Deploy Sysmon and implement .NET-based detection capabilities to capture in-process PowerShell activity that traditional logging mechanisms might miss.
• Implement Email Security: Utilize advanced email security solutions with robust attachment scanning, sandboxing, and phishing detection features.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.