Threats Tagged 'windows backdoor'

NANOREMOTE is a newly identified Windows backdoor malware closely related to the previously known FINALDRAFT malware family. It uniquely leverages the Google Drive API for stealthy data exfiltration and payload staging, complicating detection efforts. The malware communicates with a hardcoded IP over HTTP using encrypted and compressed JSON data and supports 22 command handlers for system reconnaissance, file operations, and command execution. Its modular design includes a task management system for file transfers and incorporates open-source components. NANOREMOTE’s similarity to FINALDRAFT indicates a shared codebase and development environment, suggesting ongoing evolution of this threat. Although no known exploits are reported in the wild yet, its capabilities pose a medium risk. Detection is challenging due to its use of legitimate cloud services for malicious activity. European organizations should be vigilant, especially those with Windows environments and reliance on Google Drive services.

MediumMalwareGermanyFranceNetherlands+3#command execution#file exfiltration#google drive api