Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers

This campaign targets Indian government job seekers by distributing malicious ZIP archives that contain a disguised LNK file, PowerShell downloader script, and a .NET executable. The attackers leverage the legitimate ControlR remote management tool to maintain persistent access on compromised systems. They deploy SheetAgent RAT, a custom remote access trojan written in .NET, which communicates with its command-and-control infrastructure via Google Sheets, an uncommon but stealthy C2 channel. The malware uses scheduled tasks and startup folder entries for persistence and incorporates anti-virtualization techniques to detect and evade sandbox or virtualized analysis environments. Infrastructure analysis reveals multiple web-based management panels and tradecraft similarities to the APT36 threat actor group. The campaign specifically targets Indian job seekers and related regions.

Successful compromise results in persistent remote access to infected systems via the ControlR tool and SheetAgent RAT. The attacker can execute arbitrary commands and maintain stealthy control through Google Sheets C2. The use of anti-virtualization techniques complicates detection and analysis. The campaign targets sensitive individuals seeking government jobs, potentially leading to espionage or data theft. No known exploits in the wild are reported, but the campaign's sophistication and targeting indicate a significant threat to affected users.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Mitigation focuses on user awareness to avoid opening suspicious recruitment-related ZIP archives and LNK files. Organizations should monitor for abuse of ControlR remote management tools and scheduled tasks or startup entries indicative of persistence mechanisms. Endpoint detection and response solutions should be tuned to detect PowerShell downloader scripts and unusual Google Sheets network traffic. Since this is not a cloud service, remediation depends on endpoint security controls and user education.