Spyware Spread via Google Sheets
APT36 launches a new cyber attack targeting diplomatic interests.
1New Version of SHEETCREEP Identified
Securonix threat researchers have identified an updated version of the SHEETCREEP espionage campaign. This new version uses diplomatic-themed ISO phishing lures to target Indian diplomatic interests. The malware abuses the Google Sheets API as a command-and-control channel. Researchers identified 91 active victim tabs, including a high-confidence target in Pakistan.
2APT36 Connection and Targets
The campaign is attributed with moderate confidence to Pakistan-linked APT36. Attackers have added XOR-obfuscated configurations and other anti-analysis techniques to evade detection and maintain persistent access. These techniques make it harder for security solutions to detect the malware. Targets include Indian diplomatic institutions and related organizations.
3Abuse of Google Sheets API
SHEETCREEP uses the Google Sheets API as a command-and-control channel, bypassing traditional security measures. This method allows attackers to secretly access victims' systems and steal data. By hiding behind legitimate API usage, the malware is harder to detect in security scans. Researchers warn that this technique could become more common in future cyber attacks.
4XOR Encryption and Anti-Analysis Techniques
The new SHEETCREEP version uses XOR-obfuscated configurations. This encryption method makes it difficult to analyze the malware's inner workings. Additional anti-analysis techniques further prevent detection by security researchers. These methods enable attackers to maintain long-term access and exfiltrate data.
5High-Confidence Target in Pakistan
Researchers identified a high-confidence target in Pakistan. This target is believed to be linked to Indian diplomatic interests. APT36, the group behind the attack, is known to target political and military interests in the region. Such targeted attacks have the potential to escalate international tensions.
6Impact on the Industry
The SHEETCREEP campaign has raised alarms in the cybersecurity industry. The abuse of widely used tools like Google Sheets highlights the need to review corporate security strategies. Diplomatic and government institutions may need to take additional measures against such attacks. While the full scale and impact of the attack are not yet understood, it could lead to serious data breaches.
7Future Risks
The rise of advanced spyware like SHEETCREEP indicates a diversification of cybersecurity threats. Attackers' tendency to abuse legitimate tools suggests that traditional security measures may be insufficient. Such attacks pose significant risks to critical infrastructure and diplomatic institutions. Security experts are focusing on developing new solutions to prevent similar attacks.
8Recommended Measures
Organizations should take various measures against spyware like SHEETCREEP. Additional security controls should be implemented for tools like Google Sheets. Next-generation security solutions capable of detecting XOR encryption and other anti-analysis techniques should be used. Employee awareness of phishing attacks and regular security training are also critical.
Original article: CyberWire Daily — Google Sheets Üzerinden Yayılan Casus Yazılım