Nimbus RAT is a Java-based remote access Trojan that threat actors deployed using social engineering techniques involving Microsoft Teams and Quick Assist. The attack started with an email bombing campaign and a fake IT helpdesk contact to gain remote access. The malware uses Google Drive and Google Sheets as its command-and-control infrastructure, making its network traffic appear legitimate. It bundles its own Java runtime environment, implements two credential theft mechanisms, and allows execution of second-stage code in memory. The campaign analysis revealed a high volume of suspicious Teams messages originating from throwaway onmicrosoft.com tenants. Post-compromise activities include targeting Signal Desktop and Outlook mailboxes. There is no known exploit in the wild beyond this reported campaign, and no patch or official remediation guidance has been published.

The threat enables attackers to gain remote access to victim systems through social engineering and Quick Assist, allowing credential theft and execution of additional malicious code in memory. The use of legitimate cloud services for command-and-control helps evade detection by blending malicious traffic with normal network activity. Post-compromise targeting of communication tools like Signal Desktop and Outlook mailboxes could lead to further data exfiltration or lateral movement. The attack vector relies heavily on social engineering rather than exploiting software vulnerabilities. No known exploits beyond the described campaign have been reported.

No official patch or vendor advisory is currently available for Nimbus RAT. Mitigation should focus on user awareness training to recognize social engineering and voice phishing attempts, especially those involving IT helpdesk impersonation. Restricting or monitoring Quick Assist usage and implementing multi-factor authentication can reduce risk. Network monitoring should consider unusual use of cloud services like Google Drive and Google Sheets for command-and-control. Organizations should review and restrict the creation of throwaway Microsoft 365 tenants with IT-themed names to reduce attack surface. Since no official fix exists, these preventive measures are critical.