CyberWire Daily - A RAT in the spreadsheet. [Research Saturday]

Episode Date: August 22, 2026

Today we are joined by Aaron Beardslee, Manager of Threat Research at Securonix, discussing "Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation." Securonix researchers have identified an evolved version of the SHEETCREEP espionage campaign, using a diplomatic-themed ISO phishing lure to deliver a C# remote access trojan targeting Indian diplomatic interests. The malware abuses the Google Sheets API as a stealthy command-and-control channel, with researchers identifying 91 active victim tabs, including a high-confidence target in Pakistan. The campaign, assessed with moderate confidence as linked to Pakistan-aligned APT36, has added XOR-obfuscated configurations and other anti-analysis techniques to evade detection and maintain persistent access. The research and executive brief can be found here: ⁠Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation

You're listening to the Cyberwire Network, powered by N2K. Social engineering attacks look trustworthy, a routine request, an internal email, a familiar face on a call. But Dopple sees through the disguise. Their AI-native platform detects and disrupts attacks across every channel, trains employees to recognize deepfakes and deception, and investigates every fish to take down the campaign behind it. They fight relentlessly to protect you. your business, brand, and people. Doppel, outpacing what's next in social engineering.

Learn more at Doppel.com. That's D-O-P-P-P-E-L.com. Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us. One of our researchers in India picked up, I believe it was from reversing labs, and she ran with it when she realized it was an active C-2. That's Aaron Beardsley, manager of threat research at Securonics. The research we're discussing today is titled,

Analyzing Sheet Creep. Sheet Creep is up again with different config obfuscation. Let's set the table here and tell the story for it. my understanding from reading the research is that this malware family wasn't entirely new that sheep creep activity has taken place before. Yeah, so that is something that is super interesting with this particular campaign evolution. And I personally had to look that out myself because, and same with our researchers that worked on this particular campaign was that there were, there's an existing Z-scaler research that

actually went over this sheet creep in its, I don't want to say, man, infancy, or maybe just the start of a new design of existing C2 frameworks, like custom frameworks that are coming out of what is attributed to APT-36, where they have existing rats that have been named, and then this one is that started sometime earlier in the year, that then became this now unnamed sheet creep rat. So we picked up the evolution of what we believe is the same sample that or the same attribution that Z-scaler picked up on. Well, let's walk through it together here.

How would someone find themselves in the crosshairs of these threat actors? And what happens if they find themselves infected? Typically, in this case, with this C2 campaign, is targeting the Indian government. So when it comes to other organizations or other countries, those are more like attacks of opportunity where this particular campaign is targeting geo-fenced in India.

So the things that you would be looking for, and that's one of the interesting things with sheet creep is you're asking me, how would you threat-hunt this or know you're actually infected? Am I right? Yeah. Yeah.

So this one is... And this is where when you look at the design and architecture of a threat actor's tooling, like that is the kind of appreciation for their design. That leads into my answer of this question. So trying to find where the malware actually lands. Okay, so you have the first piece is what the users do to themselves. So this one started out with an ISO. And I still, to this day, I try to understand why somebody would actually open an ISO they got from the internet.

But again, this would be somebody opens an ISO. Say they think it's legitimate for whatever reason. They have the ISO file. They open it. They see a link file that they're like, okay, this shortcut, or they don't even see or recognize it's a shortcut. shortcut. They see a PDF file. So they've fallen for the lure. And then the dropper execution, which the design of this is, and typically when you have nation state quality malware, everything is happening in the background. Even some of this stuff is hidden from our security tools. So then you have the actual schedule task that gets created.

And that's going to be where the artifacts start landing where they're visible. But this is where a normal user is probably not going to be looking. And this is where you would have to rely on your security teams to be monitoring for abnormal or new artifacts getting created in places like your Microsoft vault, an unsigned or a new binary landing in a registry key that is new. If you're monitoring for like new registry keys or new scheduled tasks getting created, and then from there, you are hoping for some kind of telemetry going outbound. And this is the aspect of sheet creep that is very hard to catch, which looking at the way they designed their C2 server,

I'm like, wow, this is really clever. Because I myself have built my fair share of malware and payloads that will call back to like AVAC or Combald Strike. And it's really challenging. So this C2 channel that goes to the Google Cloud is going to completely blend in with the rest of what someone is normally going to be doing. It's Google namespace. It's Google IP addresses.

So that part of it, the network telemetry is going to be, I would argue, off the table for your average SOC analyst. And it would take a very dedicated and skilled threat hunter to be able to, see the nuanced connection from this particular custom rat. I'm a big endpoint telemetry guy. So I'm looking for, I mean, you have your initial infection. You have, okay, the threat actor was successful in getting on your box. What do they do? Like, what are they going to execute next?

What are their steps in completing their task or fulfilling their agenda for that particular campaign. They have to do something with their session. So in this case, I would be looking for like command artifacts. What is the abnormal parent-child process relationship that's going to be tipping off a SOC analyst and even the more trained advanced threat hunters? So beginning to end, that would be where I would point someone to start looking, or at least a soft. like this is what you're going to want to look for. Well, you mentioned one of the standout elements to me, which is that they're using Google Sheets as command and control.

Can you walk us through how that works and why that's so effective? Great place for attackers to hide? Yeah, so when we first discovered this new version of how the actual, actual C2 work. So this custom payload, this rat, when it sets itself up, and then when it starts to communicate with the Google Sheets API,

it's actually enumerating the sheet that it's working off of, and it's looking at, well, am I already here? Is the system that is compromised already found in the sheet? It then looks for the tabs that it's, that has its individual compromise systems. And then it'll go through and say, okay, here's the beacon.

It's your first pulse. And then it writes the base 64 encoded commands into that sheet. and then the rat will pull for commands. It's a very clever way of, rather than the usual framework that you have in like Havoc or Cobalt Strike, where you have your beacon sessions that you can just queue up commands to send to your demons or your demons or your Cobalt Strike beacons. This is where the threat actors are just dropping their commands in the actual sheet,

and the rat is reading from that sheet and then executing based off of what is put in the cell that the rat is actually reading. And then, of course, there's the rate limiting piece where they can't overload the rat with a bunch of different commands. So that's a very high level of how that C2 channel works. Like, I'd love to see the code of that trust of Wreck. Yeah, isn't that interesting? I mean, it's somehow, despite the fact that, you know, we're talking about adversaries that there is a certain amount of curiosity and, dare I say, respect for their tradecraft?

Yeah. You know, this is, if you ever hear me talk to a crowd of red teamers, I'm like, man, you guys are so talented and creative. I would have the same kind of conversation with if I was sitting down with APT 36, but I'd be like, why do you guys have to not be good guys? Right. Couldn't you use your talents for good?

Yeah. And actually that Marcus Hutchins is a really good example of like a hacker with morality, right? Yeah. Yeah. So he was like, wait, I'm doing, I'm doing what for who? Well, we're not doing that anymore. And now he's doing really good work for the cyber. security community, like putting his skills to really good use. So, you know, props to that guy for

actually having a moral compass in trying to help versus the rest of the APT groups that are doing what they're doing. We'll be right back. One of the things that really stood out to me was your team actually authenticated to the attacker's live command and control infrastructure. That's not something we hear about every day. What did you all find when you got in there? So this is something that when I came into the management position of this team, because I'm a blue teamer at heart, but I understand that to craft a good defense, you need to have a really strong offense.

You need to know how to attack a system. And when it comes to like threat emulation, what better way to get a beat on what the bad guys are doing than to infect yourself? and monitor. So in this case, my team, whenever we have a live C2 or a good sample that is active, we will run it in our cyber range that is a fully fleshed out domain that looks real. And we go in and look at whatever C2 or whatever we can.

get out of that particular connection. In this case, we got to see the sheets. Now, full transparency, I personally wasn't the one that actually saw the connection and actually watched the enumeration of the bad guys' C2 infrastructure. But the research report that I reviewed showed that we found ourselves. in the actual sheet, and we saw the rest of what was currently collected

in that particular C2 with a bunch of, I mean, the usual automated sandboxes and researcher systems and empty sheets, and the one thing that we zero in on are like the actual real targets.

And that's because, I mean, when you have a an active C2 and we are able to connect to it. And maybe there's something we need to let an organization or authorities know. Like, we're looking for that kind of stuff. Yeah. Because if somebody's popped, we want to, you know, let them know. Hey, guys.

Right. Did you know this is happening? You know, the report describes several stealth techniques. I mean, you talk about things like hiding in the windows vault direct. and running PowerShell entirely in memory. Were there any particular techniques that either impressed you or concerned you the most from a defender's perspective? Yeah. In fact, the running in memory piece, that one, whenever, again, this is the appreciation for the creativity of the design of this particular rat and how it works. whenever I as a threat hunter,

when I'm looking at malware and I'm like, okay, that's cool. You got a connection to the system. I'm going to watch everything you do. But when you have things happening in memory, like in this case, the system management automation namespace, that the place in memory,

in the process of the rat, that's sitting in that scheduled task vault. Commands that are coming from that Google Sheets are running in that process as memory. So it's not bubbling up any kind of like PowerShell telemetry or like Sysmod Event ID1 or Windows 4688 events. Like it's very similar to, and if I had to guess, the architecture of this rat would be very similar.

to execute assembly from havoc and cobalt strike where everything's running in memory and then the results are happening either through like con host or just through that process itself. So an example of like something abnormal would be if you're enumerating active directory through your beacon or in this case this rat, you would see like strange L-DAP connections coming from a process that shouldn't be communicating to your domain controller, things like that. So that was something that I thought was really interesting with an evasion technique that this particular sample used, but then also the evolution of how they're hardening their own rat, where they're, like the previous variant with the spreadsheet IDs

where they used to be stored as plain text strings. and now they're Zor obfuscated and they have a key that's used to decrypt runtime by that just in time or that Jit function. So that's another piece of the hardening of this sample that I thought was really interesting. Yeah, those were the two big ones. I mean, there's a lot of really cool concepts that are in this. And like I said, this was very well built. Yeah. Well, given that all the network traffic looks like legitimate Google API traffic, let's say I'm a security operations senator or senator analyst.

What are some indicators that could tip me off that something's amiss? When I'm threat hunting or when I'm asked questions like these, I'm trying to visualize the flow of the actual attack. and what I could predict or expect that I could like pick up on as like an abnormality. When it comes to like abnormal behavior, in this case we have like just the network connection by itself where you have a system that is, it keeps a long running pulse to a Google Cloud like for all from a. SOX's point of view, from analyst's point of view, they're just seeing a connection to an API or to like a Google IP, and it's encrypted. I mean, it's going over 4443, H-GtPS, and you're, unless you're going to run, you know, okay, this.

If I was going to try to combat this, I just thought of this. if you have SSL inspection on your systems, then you could potentially see the decrypted mechanisms going through something like a web proxy, or if you have like Palo Alto's SSL inspection on your systems, which I would hope that government entities that are really, being targeted in this way would actually leverage that tool so that they can actually see what's happening. But beyond that, say you're a softer target and you don't have that kind of security tooling available to you, then the network traffic is probably not where you're going to catch this guy.

Well, let's touch on attribution here. The report says with moderate confidence you attribute it to APT-36. What led you to that assessment? So this is whenever we get samples that are themed in certain ways, and we look at, before we make a determination, we'll look to see like where things are connecting to, what is the name and convention. Is there any relation to other samples that are available and see if there's a common thread between like the techniques to where we can say, this particular sample we're looking at,

looking at is very similar to this other sample. It's also connecting back to C2 here. And it looks like it's targeting this particular group. So in this case, that India Strategic Partnership Week, where that is very much themed at Indian diplomatic targets and C2 infrastructure going where it was going, that's where we were looking at the relationship between the Z-scaler sample and the other APT-36 operations. So that's where that attribution was given to this particular campaign.

I see. So what do your recommendations for the defenders in our audience here? I mean, based on the information you've gathered, what are the takeaways? First and foremost, don't open up ISOs from the internet. I mean, that should go without saying, but, you know, in the case of like, and I have to be somewhat sympathetic here, because if they're, if you have a threat actor that is government aligned, they know how to take advantage of the psychological warfare piece to this. So if there's a conflict happening in a region and the opportunity to send spearfishing documents at officials in the government where your likelihood of success is higher, then they might just double click on it to be like, you know what? I need to see what this is due to either stress, panic, whatever. So slow down, be calm.

Don't just open things. The second piece, like, I don't know. Do you have file extensions enabled on your system? Well, I'm on a Mac, so. Okay. Fair point. Okay. So in this case,

but I see what you're coming from. You're going to go with this. So like when one of the things that I even tell my friends and family, like turn on your file extensions. So in the case of if you're a target of a campaign like this where you open up the ISO and you see something that has like multiple file extensions. And the last file extension is the one that you are wanting to pay attention to, then you're like, okay, this is actually not a PDF.

So that is like just a way to give yourself better insight or just know what you're, know what you're doing, know what you're clicking on. Yeah. That is the educational. component. Yeah, yeah, totally. Like the, like I said at the very beginning, like you, to a good defense requires understanding the offense.

So I try to tell the, like, my family and friends and even other colleagues, I'm like, here's some, like, do this. And you can probably catch a lot of stuff yourself. Even if you open up the ISO, because the ISO doesn't automatically execute anything. You have, it's like a two-step thing where it's like turning the safety off. turning a second safety off and then pulling the trigger. Right. From there, after those first few parts,

then it goes to like the actual SOC and Threat Hunter and Analysts where you're looking at if you haven't installed Sysmon on your endpoints or turned on PowerShell logging, although in this case the way that PowerShell is actually used, actually wouldn't bubble up that particular telemetry, but I digress. Look for schedule task creation, like abnormal schedule tasks, unsigned binaries.

If you can enable application whitelisting, it's a pain to manage, but it will stop a lot of campaigns like this. As a cell inspection, like with your web proxies, that would also help expose some of the C2 channels. So endpoint monitoring, I think when organizations rely heavily on EDR by itself and something gets past your EDR,

you're now blind to what's happening on the endpoint. So then you're relying on the rest of the flow of normal behavior in your organization and your network. So then you start threat hunting like have normal connections to other systems. So that would then go to just knowing your own environment and looking for like abnormality from an individual system. So I mean, we could keep going in the threat hunting world of all the different ways you could actually hunt down bad guys that are on a compromise system. But that's where I would start. Education, understanding what you're doing.

Don't let things cause you to panic. End point telemetry. I highly recommend Sysmon, PowerShell logging. Layer your defenses. And application white listing. Our thanks to Aaron Beardsley from Securonics for joining us. The research is titled, Analyzing Sheet Creep. Sheep creep is up again with different config obfuscation.

We'll have a link in the show notes. And that's Research Saturday, brought to you by N2K's Cyberwire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com. episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester.

Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.