SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 for Command-and-Control (APT36 / Transparent Tribe) — Threadlinqs Intelligence
As of 2026-06-12, SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 for Command-and-Control (APT36 / Transparent Tribe) is a high-severity malware threat attributed to APT36 (Pakistan), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0784 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: APT36 · Pakistan · ESPIONAGE
SHEETCREEP is a ~20 KB C# Windows remote access trojan that abuses the Google Sheets API v4 over HTTPS as its command-and-control channel, blending malicious traffic into legitimate Google Workspace
SHEETCREEP is an espionage-focused C# Windows remote access trojan first documented by Zscaler ThreatLabz in January 2026 and re-reported in an evolved form in June 2026. Its defining characteristic is living-off-trusted-services command-and-control: rather than contacting attacker-controlled infrastructure, the RAT authenticates to Google Cloud Platform using an embedded GCP service account and a bundled RSA-2048 private key, minting OAuth2 JWTs to obtain access tokens, and then reads and writes a single attacker-owned Google Sheet via the Sheets API v4. Because every request terminates at sheets.googleapis.com and oauth2.googleapis.com, network traffic is visually indistinguishable from normal Google Workspace usage, defeating domain- and reputation-based network detection.
Delivery is via spear-phishing. A diplomatic-themed lure referencing the 'UAE-India Strategic Partnership Week' delivers an ISO (UAE-India_Strategic_Partnership_Week.iso). The ISO contains a LNK shortcut (UAE-India_Strategic_Partnership-Week.lnk) disguised to look like a PDF; double-clicking it launches a C# dropper (Document_11052026-03578240540350-93.exe). The dropper writes the ~20 KB RAT payload to %LOCALAPPDATA%\Microsoft\Vault\vaultsvc.exe, masquerading as a Windows Credential Vault service.
For persistence, the RAT registers a scheduled task named WindowsVaultSyncService via the Task Scheduler COM API (rather than schtasks.exe) to avoid command-line logging; the task triggers at every user login with no time limit and carries a misleading description referencing Windows, Edge, and Discord updates. A mutex of the form Global\WinSync_<username>-<hostname>-<4char-hash> enforces single-instance execution and doubles as the per-victim identifier.
C2 configuration strings — including the spreadsheet ID and service account email — are XOR-obfuscated with the key 'discrete' and decrypted at runtime by a JIT() routine. Each victim is assigned a dedicated spreadsheet tab named from the username, hostname, and a short SHA256-derived 4-character hash. The operator writes Base64-encoded commands into Column A; the RAT writes Base64-encoded command output (with a timestamp) back into Column B. Commands are executed in-process through an embedded PowerShell runspace (System.Management.Automation), avoiding a visible powershell.exe child process and reducing process-tree telemetry. Capabilities include arbitrary command execution, system/data collection and continuous exfiltration, and lateral movement.
SHEETCREEP is also defensively aware: it profiles running processes and open window titles to detect analyst tooling such as dnSpy, Wireshark, and Network Monitor, and on detection forces an immediate reboot via Restart-Computer -Force to disrupt interactive analysis. Securonix analysts extracted the hardcoded credentials and authenticated directly to the live C2 spreadsheet (ID 1Lb5BEIsehbCGe8p1jkfWf5Mw1dBAcw5RHWFdga5gFq8), enumerating 91 active victim tabs, of which 17 appeared to be real hardware (no sandbox indicators), with a high-confidence victim in Islamabad, Pakistan. Attribution to APT36 (Transparent Tribe) is held at moderate confidence based on tradecraft and diplomatic targeting consistent with the group's history against Indian government, military, and foreign-affairs entities.
Weaknesses (CWE)
CWE-506, CWE-798, CWE-912
Target sectors: government, diplomatic, foreign affairs, military, defense
Target regions: South Asia, India, Pakistan, Middle East
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1587, T1566, T1204, T1059, T1053, T1036, T1027, T1140, T1497
