Aug 22, 2026 · 33 min
SheetCreep turns Google Sheets into an espionage control channel
A RAT in the spreadsheet. [Research Saturday]
The campaign shows how familiar cloud services can conceal malware operations targeting diplomatic interests and complicate conventional detection.
- 1SheetCreep targets Indian diplomatic interests through ISO phishing lures and a C# remote access trojan.
- 2Google Sheets and its API let attackers blend command-and-control traffic into legitimate cloud activity.
- 3Defenders can expose the campaign through endpoint telemetry, behavioral monitoring, and safer malware emulation.
Don't miss
Aaron Beardsley explains how Google Sheets API traffic can carry commands while blending into legitimate cloud-service use.
The brief
SheetCreep uses diplomatic-themed ISO files to target Indian government organizations, delivering a C# remote access trojan whose execution depends on several user and system steps.
The campaign’s defining trick is Google Sheets: attackers use the service and its API to exchange commands while making malicious traffic resemble routine cloud communication.
Aaron Beardslee describes how malware emulation in a cyber range lets defenders safely observe live command-and-control behavior rather than relying only on static samples.
Stealth comes from hiding in the Windows Vault directory and running PowerShell in memory, complicating threat hunting around ordinary-looking system activity.
Securonix assigns moderate confidence to APT36 based on targeting, infrastructure, naming conventions, and similarities to earlier samples and techniques.
The defensive response is practical: avoid unsolicited ISO files, show file extensions, collect endpoint telemetry, and watch for abnormal cloud connections and scheduled tasks.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.