Nimbus RAT (BackupBOX) — Microsoft Teams Vishing + Quick Assist Delivery of a Self-Contained Java RAT Using Google Drive/Sheets for C2 (BlackSuit Affiliate)

Key facts for Nimbus RAT Teams vishing

Detection coverage for Nimbus RAT Teams vishing

As of 2026-06-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0691 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Nimbus RAT (BackupBOX) — javaw.exe -jar Spawned by explorer.exe from ProgramData (Exploitation)

Detects the Nimbus RAT first-stage execution chain where the bundled OpenJDK 25 javaw.exe is launched with -jar from a non-standard path (e.g. C:\ProgramData\InboxCorePro\) under parent explorer.exe — the artifact produced after a victim manually extracts InboxCorePro.zip during a Quick Assist vishing session. Legitimate Java under C:\Program Files\Java\ is excluded.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.003, T1204.002, T1566.004
• Data sources: sysmon, windows_security, edr
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\javaw.exe" ParentImage="*\\explorer.exe" CommandLine="*-jar*" 
| where NOT match(Image, "(?i)C:\\\\Program Files\\\\Java\\\\") AND NOT match(Image, "(?i)C:\\\\Program Files \(x86\)\\\\Java\\\\") 
| eval suspicious_path=if(match(CommandLine, "(?i)C:\\\\ProgramData\\\\|InboxCorePro"), "high", "medium") 
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as command_lines by host, User, ParentImage, Image, suspicious_path 
| convert ctime(firstTime) ctime(lastTime) 
| table host, User, ParentImage, Image, command_lines, suspicious_path, count, firstTime, lastTime

Microsoft KQL

DeviceProcessEvents 
| where Timestamp > ago(24h) 
| where FileName =~ "javaw.exe" 
| where InitiatingProcessFileName =~ "explorer.exe" 
| where ProcessCommandLine has "-jar" 
| where FolderPath !startswith "C:\\Program Files\\Java\\" and FolderPath !startswith "C:\\Program Files (x86)\\Java\\" 
| extend SuspiciousPath = iif(ProcessCommandLine has "ProgramData" or ProcessCommandLine has "InboxCorePro", "high", "medium") 
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine, SuspiciousPath

Sigma

title: Nimbus RAT javaw.exe -jar Spawned by explorer.exe from Non-Standard Path
id: 6f1c2a90-3d4b-4e21-9a77-0691aa000001
status: experimental
description: Detects Nimbus RAT (BackupBOX) first-stage execution where bundled javaw.exe runs -jar from outside the standard Java install path under parent explorer.exe.
references:
    - https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/06
tags:
    - attack.execution
    - attack.t1059.003
    - attack.t1204.002
    - attack.initial_access
    - attack.t1566.004
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\javaw.exe'
        CommandLine|contains: '-jar'
    suspicious_path:
        CommandLine|contains:
            - 'C:\ProgramData\'
            - 'InboxCorePro'
    filter_legit:
        Image|startswith:
            - 'C:\Program Files\Java\'
            - 'C:\Program Files (x86)\Java\'
    condition: selection and not filter_legit
falsepositives:
    - Internally distributed Java applications packaged under ProgramData by IT
level: high

Known false positives:

• Internally distributed Java applications packaged under C:\ProgramData by IT
• Developer tooling launching JARs from user-writable paths via Explorer

Tuning notes: Allowlist any sanctioned internal JARs that legitimately run from ProgramData by hash or full path. Pair with Quick Assist (quickassist.exe) execution within the preceding 30 minutes to raise fidelity. Prioritize alerts where CommandLine contains InboxCorePro.

• 🔒 Nimbus RAT (BackupBOX) — Quick Assist Vishing Lead-In to javaw.exe Execution (Exploitation) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — InboxCorePro/InboxSetupPro Install & Kill-Switch/Lock Artifacts (Post-Exploitation) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — Fake Credential Prompt & In-Memory Java Compile C2 Commands (C2/Lateral Movement) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — [indicator] Download from SharePoint/OneDrive after Pastebin Instructions (Exploitation) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — Startup-Folder Launcher & HKCU Run Key for javaw.exe -jar (Post-Exploitation) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — BackupBOX OAuth Drive Grant & entry_/exit_ Drive C2 Pattern (C2/Lateral Movement) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — regedit.exe Importing .reg from ProgramData & Startup Run-Key Persistence (Post-Exploitation) · unlock with TL Creds
• 🔒 Nimbus RAT (BackupBOX) — javaw.exe Google Drive RSA-4096 C2 Polling (C2/Lateral Movement) · unlock with TL Creds

Indicators of compromise for Nimbus RAT Teams vishing

As of 2026-06-06, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-0691.

Sample indicators (3 of 30)

• Domain: system-clean[.]top
• URL: hxxps://pastebin[.]com/G6jA0PLU
• File hash: 9E5B1E10AD6904D3F5B48D38470CD57263974640A27D13CF793EF026D3D6B886

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How Nimbus RAT Teams vishing works

TRU links the activity to a BlackSuit affiliate that emerged after Black Basta's early-2025 internal conflict, observing 1,540 suspicious Teams interactions across 172 organizations over 12 months with a sharp surge in Dec 2025-Mar 2026.

Nimbus RAT is a Java-based remote access trojan distributed through a fully social-engineered, hands-on-keyboard intrusion chain that abuses trusted SaaS and OS tooling across the entire kill chain. eSentire's Threat Response Unit (TRU) reconstructed a representative April 6, 2026 intrusion against a legal-sector organization.

INTRUSION CHAIN: (1) Email bombing — the victim mailbox was flooded with ~282 legitimate transactional/subscription-confirmation emails (peak 26/min) from 116 unique sender domains over ~90 minutes (16:00-17:30 UTC), manufacturing urgency and a pretext for help. (2) Teams vishing — within ~45 minutes (~17:45 UTC) an external Microsoft Teams account on a throwaway *.onmicrosoft.com trial tenant, posing as internal IT helpdesk, contacted the user referencing the inbox flood and offered to help. (3) Remote access — the actor directed the user to launch Quick Assist via Windows Explorer, gaining an interactive remote session by 17:48 UTC. (4) Instruction delivery — the actor pasted a Pastebin URL (pastebin.com/G6jA0PLU, visited 17:53 UTC) into Teams chat containing a four-line human-readable checklist: download path, extraction directory, registry import, and Startup persistence step. (5) Payload staging — the archive InboxCorePro.zip was hosted on a compromised Microsoft 365 tenant's personal OneDrive (*-my.sharepoint.com), downloaded 17:54-17:56 UTC. (6) Execution & persistence — the user extracted to C:\ProgramData\InboxCorePro\, imported InboxCorePro.reg via regedit.exe (17:59:28 UTC) placing a launcher in the Startup folder; javaw.exe then executed InboxCorePro.jar at 17:59:32 UTC under parent explorer.exe. The actor returned via a second Quick Assist session at 18:04 UTC.

MALWARE: Nimbus RAT (internal name BackupBOX, OAuth app name BackupBOX, campaign UUID 1hc1his4gmto0q1) is self-contained — it ships its own OpenJDK 25.0.1 javaw.exe so no system Java is required. A %TEMP%\java_app.lock file enforces single-instance execution, and a license.txt kill-switch file prevents relaunch if removed. Java packages are name-obfuscated (BlackStatelessness, DomitianUndrapedEpigrammatize, EpitaphDunderhead, Goferindubitably, Splendrousstile, WorldlySiege, sententiousness, ExtricableSophisticated); entry point Goferindubitably.Audiometric, command handler Splendrousstile.SomewhatJerky, code execution DomitianUndrapedEpigrammatize.MutagenInchoateness.

COMMAND-AND-CONTROL: Three RSA-4096-encrypted channels. (a) Google Drive service account (class Keenplainspokenness) via ServiceAccountCredentials JSON key; (b) Google Drive OAuth2 user (class Intervention) via client_id+client_secret+refresh_token with rate-limit retry (7 attempts); (c) direct TLS socket (class phonemicsVandalism) with certificate validation disabled and RSA length-prefixed messages. Normal poll interval 45-75s, accelerated 4-8s wakeup poll. C2 files follow entry_{campaignUUID} (commands), exit_{campaignUUID} (responses), newconfig_* (config updates); large messages are chunked. All traffic uses a hardcoded 4096-bit RSA public key.

CAPABILITIES: Shell (cmd.exe /c, direct ProcessBuilder 'r' with 30s timeout, silent 'exec' to NUL); file ops (ls/dir, type, del/rm recursive, cd, tree max 5000, regex find max 5000, ZIP za/tz/z); registry full access (HKLM/HKCU/HKCR/HKU/HKCC query/add/delete); recon via JNA (GetNetworkParams/GetAdaptersInfo, sysinfo, domain/group membership); Robot screenshot to ZIP; and second-stage in-memory Java compile/execute (jc blocking, jcb backgrounded) accepting Base64 source where '/// https://' lines fetch dependency JARs to %TEMP%\libs\, compiled via javax.tools with no disk writes (MemoryClassLoader). Self-destruct ('self'): timeout /t 2 & RD /S /Q {jdkPath} then System.exit(0).

CREDENTIAL THEFT: 'lf' renders a fake Java Swing Windows Security dialog (DOMAIN\username pre-filled, 'Remember credentials' box) that fakes an 'incorrect' error on the first attempt and exfiltrates both password entries; 'cf' invokes the real CredUIPromptForCredentialsW (credui.dll) via JNA with caption 'Login', allows one retry, auto-closes after ~10 minutes via WM_CLOSE.

SECOND STAGE: An InboxSetupPro component (C:\ProgramData\InboxSetupPro\) exfiltrates to OneDrive, specifically targeting the Signal Desktop attachment cache (AppData\roaming\signal\attachments.noindex) and Outlook OST files (a 1.13 GB victim-named ZIP was recovered).

PERSISTENCE NOTE: Nimbus has no autonomous persistence — the operator manually stages the Startup launcher and .reg import during the Quick Assist session, so a host isolated before the operator acts will not retain the infection across reboot.

ATTRIBUTION: TRU attributes the activity to a BlackSuit affiliate (previously documented by Rapid7 in June 2025), emerging after Black Basta's early-2025 chat-leak fallout, with timing alignment to Storm-1811 and 3AM ransomware tradecraft (Dec 2025-Mar 2026). Initial-access telemetry: 1,540 suspicious external Teams messages across 172 environments (May 2025-May 2026); 65% from *.onmicrosoft.com trial tenants (235 unique throwaway tenants), 49% impersonating IT/helpdesk, 80% sourced from hosting/datacenter ASNs, with a fast-burning PDR-registered .top domain cluster (37% of non-onmicrosoft domains ≤7 days old).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573 Encrypted Channel

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Credential Access

T1056 Input Capture

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

Defense Evasion

T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

defense-impairment

T1112 Modify Registry

Initial Access

T1199 Trusted Relationship; T1566 Phishing

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1583 Acquire Infrastructure

Remediation for Nimbus RAT Teams vishing

Immediate actions

• Block or restrict inbound external Microsoft Teams chat/calls from unknown and *.onmicrosoft.com tenants (External Access allowlist)
• Disable or restrict Quick Assist (remove/AppLocker-block quickassist.exe) where not operationally required
• Hunt for and remove C:\ProgramData\InboxCorePro\ and C:\ProgramData\InboxSetupPro\ directories and Startup-folder launchers
• Terminate javaw.exe running -jar from non-standard paths; isolate affected hosts before the operator can re-establish
• Revoke OAuth grants to the 'BackupBOX' application and any unauthorized Drive-scope service accounts in Google Workspace

Workarounds

• Set Teams external access to allowlist-only trusted federated domains
• Block pastebin.com at proxy or alert on browser visits following external Teams messages
• Alert on bulk inbound mail spikes (email-bombing) per mailbox

Longer-term hardening

• Deploy EDR with behavioral detection for explorer.exe->javaw.exe and regedit.exe importing .reg from C:\ProgramData
• Implement user awareness training on email-bombing + IT-helpdesk vishing lures
• Enforce least privilege and block user-writable autostart locations
• Monitor Google Workspace audit logs for service-account/OAuth Drive activity from non-authorized apps

Affected and fixed versions

• Microsoft — Microsoft Teams (External Access / Federation)
  Vulnerable versions: External chat enabled for unknown tenants
• Microsoft — Quick Assist (Windows remote assistance)
  Vulnerable versions: Windows 10; Windows 11
• Microsoft — Microsoft 365 / SharePoint / OneDrive (compromised tenant abuse)
  Vulnerable versions: M365 tenants
• Google — Google Drive / Google Sheets API (C2 abuse)
  Vulnerable versions: Drive API v3

Timeline of Nimbus RAT Teams vishing

• 2025-05-01 Start of eSentire TRU 12-month telemetry window tracking suspicious external Teams messages (May 2025-May 2026).
• 2025-06-01 Rapid7 publishes prior reporting on the BlackSuit-affiliate Java RAT activity later tracked as Nimbus RAT.
• 2025-12-01 Sharp rise in Teams-vishing activity begins; Dec 2025-Mar 2026 accounts for 57% of annual volume.
• 2026-02-01 February 2026 alone records 408 suspicious Teams events — roughly 8x baseline.
• 2026-04-06 18:04 UTC: threat actor returns via a second Quick Assist session for hands-on-keyboard operations.
• 2026-04-06 17:59:28 UTC locked-ioc-21 imported via regedit.exe; 17:59:32 UTC javaw.exe executes locked-ioc-20 under explorer.exe.
• 2026-04-06 17:54-17:56 UTC: locked-ioc-22 downloaded from a compromised M365 *-my.sharepoint.com OneDrive.
• 2026-04-06 17:53 UTC: victim visits pastebin.com/G6jA0PLU containing the four-line download/persistence checklist.
• 2026-04-06 17:48 UTC: victim launches Quick Assist, granting the actor an interactive remote session.
• 2026-04-06 ~17:45 UTC: external Teams account on a throwaway onmicrosoft.com tenant posing as IT helpdesk contacts the victim.
• 2026-04-06 16:00-17:30 UTC: victim mailbox flooded with ~282 subscription-confirmation emails (peak 26/min) from 116 sender domains.
• 2026-06-04 eSentire TRU publishes the Nimbus RAT analysis detailing the full chain, malware internals, and telemetry.
• 2026-06-05 SOC Prime publishes detection-focused coverage of Nimbus RAT delivery via Teams and Google Drive.

Sources cited for Nimbus RAT Teams vishing

• Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT esentire.com · Research · 2026-06-04
• Rapid7 — BlackSuit affiliate Java RAT prior reporting Rapid7 · Vendor report · 2025-06-01
• MITRE ATT&CK — Phishing: Spearphishing Link (T1566.002) MITRE · Research · 2026-06-06
• Microsoft — Storm-1811 / Quick Assist social engineering guidance Microsoft · Vendor report · 2026-06-06
• Nimbus RAT Delivered Through Microsoft Teams and Google Drive (SOC Prime) socprime.com · Blog · 2026-06-05

Threats related to Nimbus RAT Teams vishing

• Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google Drive C2
• Fake AI Tool Attacks on SMBs: 33,300 Cyberattacks Masquerading as ChatGPT, Copilot, Claude in Early 2026
• Cloud vn105rkj64 — Italian Invoice Phishing Drops Windows Backdoor and Force-Installed Chrome Extension Abusing Native Messaging for Cookie Theft, MFA Bypass, and Remote PowerShell
• Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise
• macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections

Related coverage of this activity

• The Quarry PhaaS
• EKZ infostealer campaign

Previous and next in malware

• Operation FlutterBridge — FlutterShell macOS Backdoor via Malicious Google/YouTube Ads (CL-CRI-1089) Previous report
• Magecart Skimmer Abuses Stripe API + Google Tag Manager for Payload Hosting, C2 & Card Exfiltration Next report