The newly identified SHEETCREEP remote access trojan targets diplomatic organizations by using the Google Sheets API as a covert command-and-control channel for exfiltrating data. Security teams should monitor for suspicious HTTPS traffic to Google Workspace, as the malware executes commands in-process to avoid detection by standard monitoring tools. The use of XOR-encrypted configuration strings and persistence via scheduled tasks underscores the evolving sophistication of state-aligned groups targeting government and military institutions.
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
11
Ali NematiWritten by Ali
