A RAT in the spreadsheet. [Research Saturday]

Key takeaways

Shell Creep is an advanced malware campaign exploiting Google Sheets as a stealthy command-and-control channel, posing detection challenges.
Effective defense involves endpoint monitoring, disabling unneeded file extensions, and SSL inspection to catch subtle techniques.
Users should be cautious of opening suspicious ISO files and look for signs like multiple file extensions as indicators of malicious activity.
Threat actors are highly creative, employing in-memory execution, obfuscation, and legitimate cloud services to evade detection.
Active threat hunting and understanding attack flows are crucial for identifying and mitigating sophisticated campaigns like Shell Creep.
Attribution relies on analyzing infrastructure, themes, and techniques, with moderate confidence linking this campaign to APT36.

Summary

Introduction and Campaign Overview

The podcast begins with an introduction to the topic of Shell Creep, a sophisticated espionage malware campaign that has evolved with new configurations and obfuscation techniques. The research is linked to a campaign targeting Indian diplomatic interests, with potential attribution to Pakistan-aligned APT36. The campaign uses Google Sheets as a malicious command-and-control channel, making detection challenging and highlighting the creativity of threat actors.

Technical Analysis of Shell Creep

The discussion dives into the technical details of Shell Creep, emphasizing how the malware is delivered via phishing ISO files that lure users into executing dropper files, such as PDFs or shortcuts. Once infected, the malware creates scheduled tasks and uses memory-based, in-memory PowerShell execution to evade detection. Its C2 communication employs Google Sheets API, with commands encoded and stored in spreadsheets that the malware reads in a polling fashion. The malware also employs obfuscation, anti-analysis techniques, and mimics legitimate Google traffic to hide its activity.

Detection and Defensive Measures

The episode offers practical advice for defenders, emphasizing the importance of endpoint monitoring, disabling unnecessary file extensions, and enabling SSL inspection to detect anomalies. It suggests looking for abnormal schedule task creation, unsigned binaries, and unusual LDAP traffic. Additionally, the podcast highlights the importance of understanding the attack flow, doing threat hunting, and recognizing the subtle indicators of compromise associated with Sheet Creep, such as persistent connectivity to Google Cloud APIs and in-memory PowerShell activity.

Research and Attribution Insights

Researchers at Securonix, led by Aaron Beardsley, conducted active threat emulation by connecting to the threat actor’s C2 infrastructure to observe operations firsthand. The research team assessed with moderate confidence that this campaign is linked to APT36 due to its targeting of Indian diplomatic targets and shared infrastructure. The analysis underscores the importance of attribution based on behavior, infrastructure, and targeted themes.

Final Recommendations and Conclusion

The discussion concludes with recommendations for organizations to prevent falling victim to such campaigns: avoid opening suspicious ISO files, enable file extension visibility, use SSL inspection, and implement robust endpoint protections like application whitelisting. The importance of understanding the attacker’s methods to improve defense posture is emphasized, along with the critical role of education and vigilance.

Show notes

Today we are joined by Aaron Beardslee, Manager of Threat Research at Securonix, discussing "Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation." Securonix researchers have identified an evolved version of the SHEETCREEP espionage campaign, using a diplomatic-themed ISO phishing lure to deliver a C# remote access trojan targeting Indian diplomatic interests.

The malware abuses the Google Sheets API as a stealthy command-and-control channel, with researchers identifying 91 active victim tabs, including a high-confidence target in Pakistan. The campaign, assessed with moderate confidence as linked to Pakistan-aligned APT36, has added XOR-obfuscated configurations and other anti-analysis techniques to evade detection and maintain persistent access.

The research and executive brief can be found here:

⁠Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation

Learn more about your ad choices. Visit megaphone.fm/adchoices