MalwarePublished 10 Dec 2025

NANOREMOTE, cousin of FINALDRAFT

Source AlienVault OTX General

Description

NANOREMOTE is a newly identified Windows backdoor malware closely related to the previously known FINALDRAFT malware family. It uniquely leverages the Google Drive API for stealthy data exfiltration and payload staging, complicating detection efforts. The malware communicates with a hardcoded IP over HTTP using encrypted and compressed JSON data and supports 22 command handlers for system reconnaissance, file operations, and command execution. Its modular design includes a task management system for file transfers and incorporates open-source components. NANOREMOTE’s similarity to FINALDRAFT indicates a shared codebase and development environment, suggesting ongoing evolution of this threat. Although no known exploits are reported in the wild yet, its capabilities pose a medium risk. Detection is challenging due to its use of legitimate cloud services for malicious activity. European organizations should be vigilant, especially those with Windows environments and reliance on Google Drive services.

Impact

For European organizations, NANOREMOTE presents a notable risk primarily to Windows-based environments, especially those utilizing Google Drive for business operations. The malware’s ability to exfiltrate sensitive data via Google Drive API can lead to significant confidentiality breaches, including intellectual property theft, exposure of personal data, and leakage of strategic business information. The command execution capabilities allow attackers to manipulate infected systems, potentially leading to further lateral movement, persistence, and disruption of business operations. The use of encrypted and compressed communications over HTTP complicates network monitoring and intrusion detection, increasing the likelihood of prolonged undetected presence. Organizations in sectors with high reliance on cloud services and sensitive data, such as finance, healthcare, and government, may face elevated risks. Additionally, the malware’s modular design and task management system enable flexible and sustained attacks, which could result in operational disruptions and reputational damage. Although no active widespread exploitation is reported, the potential for targeted attacks against European entities is significant, especially given the malware’s stealthy exfiltration method and extensive command set.

Defensive guidance

European organizations should implement multi-layered defenses tailored to detect and disrupt NANOREMOTE’s unique tactics. First, enhance endpoint detection and response (EDR) capabilities to identify suspicious behaviors such as unusual use of Google Drive API calls, especially those involving automated or bulk file transfers inconsistent with normal user activity. Network monitoring should include inspection of HTTP traffic for encrypted and compressed JSON payloads communicating with known malicious IP addresses, leveraging threat intelligence feeds containing NANOREMOTE indicators such as file hashes and C2 IPs. Employ strict application control policies to prevent execution of unauthorized or unknown binaries, including custom PE loaders. Enforce least privilege principles to limit user and process permissions, reducing the malware’s ability to execute commands or access sensitive files. Regularly audit and monitor Google Drive API usage logs for anomalies. Implement anomaly detection systems that correlate endpoint and network data to identify lateral movement or reconnaissance activities. Since NANOREMOTE uses hardcoded IPs, blocking these IPs at the firewall and proxy level can reduce exposure. Finally, maintain up-to-date threat intelligence and share findings with relevant European cybersecurity communities to improve collective defense.

Summary

NANOREMOTE is a sophisticated Windows backdoor malware discovered recently, bearing strong code and functional similarities to the FINALDRAFT malware family. Its primary innovation is the use of the Google Drive API for exfiltrating data and staging payloads, which allows it to blend malicious traffic with legitimate cloud service communications, thereby evading traditional network detection mechanisms. The malware communicates with a hardcoded command and control (C2) server via HTTP, transmitting encrypted and compressed JSON-formatted data to avoid easy inspection. NANOREMOTE includes a comprehensive task management system that handles file transfers efficiently and supports 22 distinct command handlers enabling a wide range of malicious activities such as system reconnaissance (e.g., gathering system information and user details), file operations (upload, download, delete), and arbitrary command execution on the infected host. The malware also uses a custom PE loader and integrates functionality from open-source projects, indicating a modular and extensible architecture. The shared codebase with FINALDRAFT suggests that the threat actors are iterating on their tools to improve stealth and functionality. Despite no current reports of widespread exploitation, the malware’s design to leverage trusted cloud infrastructure and its extensive capabilities make it a significant threat. Detection and mitigation are complicated by its use of legitimate APIs and encrypted communications, requiring advanced behavioral and network analysis techniques.

Indicators of compromise

Hashes 11

1e28c01387e0f0229a3fb3df931eaf80
558bec83ec40535657833d7440001c00
7000b9fc622f702b4d1b38b567a9dc1a
d5370a1b685f54055154c1062434ca473cdd31f5
35593a51ecc14e68181b2de8f82dde8c18f27f16fcebedbbdac78371ff4f8d41
57e0e560801687a8691c704f79da0c1dbdd0f7d5cc671a6ce07ec0040205d728
999648bd814ea5b1e97918366c6bd0f82b88f5675da1d4133257b9e6f4121475
b26927ca4342a19e9314cf05ee9d9a4bddf7b848def2db941dd281d692eaa73c
fff31726d253458f2c29233d37ee4caf43c5252f58df76c0dced71c4014d6902
0ed540c8c2bd97839907459f9da6f506e781f7bb

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Dec 2025, 09:24 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Hashes 11

Community reviews

Related threats