Threats Tagged 'google drive c2'

Nimbus RAT is a Java-based remote access Trojan deployed in April 2026 targeting the legal industry via Microsoft Teams voice phishing. The attack involved an initial email bombing campaign followed by social engineering through a fake IT helpdesk contact on Teams, convincing the victim to grant Quick Assist remote access. The RAT uses Google Drive and Google Sheets for command-and-control, blending its network traffic with benign cloud service usage. It includes its own Java runtime, two credential theft methods, and supports in-memory second-stage code execution. Post-compromise activities targeted Signal Desktop attachments and Outlook mailboxes. Analysis showed many suspicious Teams messages originated from throwaway Microsoft tenants with IT-themed names. No official patch or vendor advisory is available for this threat.