Threat reportMalwareTL-2026-0784
SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 for Command-and-Control (APT36 / Transparent Tribe)
SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 (TL-2026-0784), also tracked as SHEETCREEP, is a high-severity malware campaign, first published 2026-06-12. It is attributed to APT36 (Pakistan) with medium confidence, affects Microsoft Windows, maps to 24 MITRE ATT&CK techniques (T1005, T1010, T1021), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 1APT36
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-0784
- Threat ID
- TL-2026-0784
- Also known as
- SHEETCREEP
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT36
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Pakistan
- Motivation
- ESPIONAGE
- Target sectors
- government, diplomatic, foreign affairs, military, defense
- Target regions
- South Asia, India, Pakistan, Middle East
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4
Malware and tooling: SHEETCREEP, Google Sheets API v4 (living-off-trusted-services C2)
How SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 works
SHEETCREEP is a ~20 KB C# Windows remote access trojan that abuses the Google Sheets API v4 over HTTPS as its command-and-control channel, blending malicious traffic into legitimate Google Workspace activity. Operator commands and Base64-encoded responses are exchanged through spreadsheet columns, with a dedicated per-victim tab keyed by username, hostname, and a 4-character hash. Researchers authenticated to the live C2 spreadsheet using credentials extracted from the binary and found 91 active victim tabs (17 assessed as real targets), including a high-confidence target in Islamabad, Pakistan. Assessed with moderate confidence as linked to APT36 (Transparent Tribe), a Pakistan-aligned actor targeting Indian diplomatic and government organizations.
SHEETCREEP is an espionage-focused C# Windows remote access trojan first documented by Zscaler ThreatLabz in January 2026 and re-reported in an evolved form in June 2026. Its defining characteristic is living-off-trusted-services command-and-control: rather than contacting attacker-controlled infrastructure, the RAT authenticates to Google Cloud Platform using an embedded GCP service account and a bundled RSA-2048 private key, minting OAuth2 JWTs to obtain access tokens, and then reads and writes a single attacker-owned Google Sheet via the Sheets API v4. Because every request terminates at sheets.googleapis.com and oauth2.googleapis.com, network traffic is visually indistinguishable from normal Google Workspace usage, defeating domain- and reputation-based network detection.
Delivery is via spear-phishing. A diplomatic-themed lure referencing the 'UAE-India Strategic Partnership Week' delivers an ISO (UAE-India_Strategic_Partnership_Week.iso). The ISO contains a LNK shortcut (UAE-India_Strategic_Partnership-Week.lnk) disguised to look like a PDF; double-clicking it launches a C# dropper (Document_11052026-03578240540350-93.exe). The dropper writes the ~20 KB RAT payload to %LOCALAPPDATA%\Microsoft\Vault\vaultsvc.exe, masquerading as a Windows Credential Vault service.
For persistence, the RAT registers a scheduled task named WindowsVaultSyncService via the Task Scheduler COM API (rather than schtasks.exe) to avoid command-line logging; the task triggers at every user login with no time limit and carries a misleading description referencing Windows, Edge, and Discord updates. A mutex of the form Global\WinSync_<username>-<hostname>-<4char-hash> enforces single-instance execution and doubles as the per-victim identifier.
C2 configuration strings — including the spreadsheet ID and service account email — are XOR-obfuscated with the key 'discrete' and decrypted at runtime by a JIT() routine. Each victim is assigned a dedicated spreadsheet tab named from the username, hostname, and a short SHA256-derived 4-character hash. The operator writes Base64-encoded commands into Column A; the RAT writes Base64-encoded command output (with a timestamp) back into Column B. Commands are executed in-process through an embedded PowerShell runspace (System.Management.Automation), avoiding a visible powershell.exe child process and reducing process-tree telemetry. Capabilities include arbitrary command execution, system/data collection and continuous exfiltration, and lateral movement.
SHEETCREEP is also defensively aware: it profiles running processes and open window titles to detect analyst tooling such as dnSpy, Wireshark, and Network Monitor, and on detection forces an immediate reboot via Restart-Computer -Force to disrupt interactive analysis. Securonix analysts extracted the hardcoded credentials and authenticated directly to the live C2 spreadsheet (ID 1Lb5BEIsehbCGe8p1jkfWf5Mw1dBAcw5RHWFdga5gFq8), enumerating 91 active victim tabs, of which 17 appeared to be real hardware (no sandbox indicators), with a high-confidence victim in Islamabad, Pakistan. Attribution to APT36 (Transparent Tribe) is held at moderate confidence based on tradecraft and diplomatic targeting consistent with the group's history against Indian government, military, and foreign-affairs entities.
MITRE ATT&CK techniques used in TL-2026-0784
Collection
Discovery
T1010 Application Window Discovery; T1057 Process Discovery; T1082 System Information Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel
Credential Access
Initial Access
Resource Development
Affected products and versions in SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4
Remediation for SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4
Immediate actions
- Hunt for %LOCALAPPDATA%\Microsoft\Vault\vaultsvc.exe and quarantine matching SHA256 62d62950ff7a0e43550a5d0ba55d32d5083b9de5538e0f012e406b6d951e16aa
- Hunt for and remove the scheduled task 'WindowsVaultSyncService' (registered via the Task Scheduler COM API)
- Block/alert on the C2 spreadsheet ID 1Lb5BEIsehbCGe8p1jkfWf5Mw1dBAcw5RHWFdga5gFq8 and the GCP service account sheet5-495707@sheetcreep-serviceaccount.iam.gserviceaccount.com in proxy/DLP logs
- Block delivery of ISO/IMG email attachments at the mail gateway; alert on LNK files inside mounted ISOs
Workarounds
- Apply ASR rules blocking executable content from email and webmail
- Use a CASB/SSE to baseline Google Workspace API usage and flag service-account-authenticated Sheets API access from corporate endpoints
Longer-term hardening
- Deploy EDR with behavioral detection for in-process PowerShell (System.Management.Automation runspaces) without a powershell.exe child
- Restrict or monitor outbound access to sheets.googleapis.com / oauth2.googleapis.com from non-Workspace endpoints and inspect for non-browser, service-account JWT auth flows
- Disable automatic mounting of ISO/IMG files via Group Policy / Attack Surface Reduction rules
- Enforce mark-of-the-web propagation and block execution of LNK files originating from removable/mounted media
Weaknesses (CWE) in SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4
Timeline of SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4
- SHEETCREEP C# RAT first documented by Zscaler ThreatLabz, identifying Google Sheets API abuse as the C2 channel.
- Espionage campaign observed in the wild targeting diplomatic organizations using a UAE-India Strategic Partnership Week phishing lure delivered via ISO.
- C# dropper file naming references date 11-05-2026 (Document_11052026-03578240540350-93.exe), consistent with a May 2026 distribution wave.
- Evolved SHEETCREEP variant observed with upgraded evasion (in-process PowerShell runspace, COM-based task registration, analyst-tool detection).
- Securonix extracted hardcoded credentials from the RAT binary and authenticated to the live C2 spreadsheet, enumerating 91 active victim tabs.
- Of 91 victim tabs, 17 assessed as real hardware (no sandbox indicators); a high-confidence target identified in Islamabad, Pakistan.
- Threat ingested into the Threadlinqs Intelligence Platform as TL-2026-0784 for detection engineering and IOC blocking.
- Public reporting (Cyber Security News, GBHackers, Cyberpress, SOC Prime) details the campaign and moderate-confidence attribution to APT36 / Transparent Tribe.
Sources cited for SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4
- SHEETCREEP C# RAT Abuses Google Sheets API as C2 to Target Diplomatic Organizations
- Hackers Abuse Google Sheets Tabs to Control 91 Victims in SHEETCREEP Campaign
- Hackers Use UAE-India Diplomatic Lure to Deliver SHEETCREEP RAT via Google Sheets
- Sheet Attack Uses Google Sheets and Graph API for C2 — APT Attacks Targeting Indian Government
- Zscaler ThreatLabz — initial SHEETCREEP documentation (January 2026)
- MITRE ATT&CK — Transparent Tribe (G0134)
Detection coverage for TL-2026-0784
As of 2026-06-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0784 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0784
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.