Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google Drive C2

Nimbus RAT: Java-based Remote Access Trojan Delivered via (TL-2026-0847), also tracked as BackupBOX, is a high-severity malware campaign, first published 2026-05-28. It is attributed to BlackSuit affiliate with medium confidence, affects Microsoft Windows endpoints with Quick Assist enabled, maps to 31 MITRE ATT&CK techniques (T1005, T1010, T1016), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0847

Threat ID
TL-2026-0847
Also known as
BackupBOX, Nimbus RAT
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-05-28
Last reviewed
2026-05-28
Attribution
BlackSuit affiliate
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
legal, professional services, technology, financial
Target regions
North America, Europe
Detection rules
9
Indicators of compromise
30

Malware and tooling in Nimbus RAT: Java-based Remote Access Trojan Delivered via

Malware and tooling: BackupBOX

eSentire's Threat Response Unit documents Nimbus RAT, a self-contained Java RAT (internal name "BackupBOX") bundling its own OpenJDK 25 runtime and using Google Drive/Google Sheets as an RSA-4096-encrypted command-and-control channel. Operators chain email bombing, Microsoft Teams IT-helpdesk vishing, and Quick Assist remote control to reach RAT execution in under 20 minutes, with activity linked to BlackSuit/Storm-1811 ransomware affiliates.

How Nimbus RAT: Java-based Remote Access Trojan Delivered via works

Nimbus RAT is a Java-based remote access trojan tracked by eSentire's Threat Response Unit (TRU) following an April 6, 2026 intrusion against a legal-industry customer. The campaign is a living-off-trusted-services operation that abuses legitimate cloud platforms end to end: Microsoft Teams for initial contact, Microsoft SharePoint/OneDrive for payload staging, Pastebin for human-readable installation instructions, and Google Drive plus Google Sheets for command-and-control and exfiltration.

The intrusion begins with an email-bombing phase (282 subscription-confirmation emails from 116 sender domains over ~90 minutes), which manufactures urgency and sets up a follow-up Microsoft Teams contact from an external tenant impersonating internal IT support. Roughly 45 minutes after the bombing peak, the actor reaches the victim over Teams, persuades them to launch Windows Quick Assist, performs reconnaissance via cmd.exe (net time /domain), and directs the user to a Pastebin checklist (pastebin.com/G6jA0PLU). The checklist instructs the victim to download InboxCorePro.zip from a compromised SharePoint tenant, import InboxCorePro.reg via regedit, and execute InboxCorePro.jar with javaw.exe. From first Teams contact to RAT execution elapsed under 20 minutes.

Nimbus RAT (internal identifier "BackupBOX", campaign UUID 1hc1his4gmto0q1, entry class Goferindubitably.Audiometric) ships a full OpenJDK 25.0.1 runtime so it runs regardless of host Java state, and is obfuscated with randomized English-word package names. On launch it creates a single-instance lock at %TEMP%\java_app.lock, registers a JVM shutdown hook, verifies its configuration against an embedded 4096-bit RSA public key, and enforces a license.txt kill switch (exiting via System.exit(0) if absent). It then enters a priority-based C2 polling loop. Command and control runs over the Google Drive API using either a ServiceAccountCredentials JSON key channel ("Keenplainspokenness"), an OAuth2 refresh-token channel ("Intervention") under an OAuth application named "BackupBOX" requesting the drive scope, or a cert-validation-disabled channel ("phonemicsVandalism"). Command files are named entry_{UUID}, responses exit_{UUID}, and config updates newconfig_{prefix}; all payloads are RSA-4096 signed/encrypted and chunked. Normal polling is 30-75s, droppable to a 4-8s "wakeup" cadence for up to 10 minutes. Because all traffic resolves to googleapis.com/docs.google.com, network-layer blocking is impractical and detection must be process-behavioral.

Capabilities include arbitrary command execution, full registry access (HKLM/HKCU/HKCR/HKU/HKCC via Advapi32Util), file system manipulation, screenshot capture, network/adapter enumeration via JNA (GetAdaptersInfo/GetNetworkParams), credential theft through both fake Java Swing dialogs (lf) and native Windows CredUIPromptForCredentialsW prompts (cf), window-focus theft (SetForegroundWindow/AttachThreadInput), and in-memory compilation/execution of attacker-supplied Java source (jc/jcb commands) with no disk writes via javax.tools.JavaCompiler and a HashMap-backed MemoryClassLoader. Persistence is operator-driven rather than autonomous: a pre-staged InboxCorePro.reg run key and Startup-folder launcher mean infection does not survive reboot if the host is isolated before the operator acts. A distinct second-stage tool, InboxSetupPro (C:\ProgramData\InboxSetupPro\), exfiltrates over OneDrive and was observed staging a 1.13 GB archive targeting Signal Desktop attachments and Outlook OST data.

Across a May 2025-May 2026 dataset, eSentire observed 1,540 malicious external Teams interactions across 172 organizations, peaking in February 2026 (408 events, ~8x baseline). 65% of messages came from throwaway *.onmicrosoft.com tenants (235 unique), 49% used IT/helpdesk impersonation, and 80% originated from hosting/datacenter ASNs with cross-customer IP and tenant reuse. eSentire and Rapid7 associate the activity with BlackSuit affiliates (a Black Basta successor) and Storm-1811/3AM-aligned ransomware operations.

MITRE ATT&CK techniques used in TL-2026-0847

Collection

T1005 Data from Local System; T1113 Screen Capture

Discovery

T1010 Application Window Discovery; T1016 System Network Configuration Discovery; T1087 Account Discovery; T1124 System Time Discovery; T1538 Cloud Service Dashboard

Exfiltration

T1020 Automated Exfiltration; T1030 Data Transfer Size Limits; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Credential Access

T1056 Input Capture; T1110 Brute Force

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1132 Data Encoding; T1219 Remote Access Tools; T1573 Encrypted Channel

Initial Access

T1199 Trusted Relationship; T1566 Phishing

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts

Reconnaissance

T1589 Gather Victim Identity Information

Affected products and versions in Nimbus RAT: Java-based Remote Access Trojan Delivered via

  • Microsoft — Windows endpoints with Quick Assist enabled
    Vulnerable versions: Windows 10; Windows 11
  • Microsoft — Microsoft Teams (external federation enabled)
    Vulnerable versions: Teams with unrestricted external/trial-tenant messaging
  • Google — Google Workspace (Drive/Sheets used as C2)
    Vulnerable versions: Workspace tenants without OAuth app governance

Remediation for Nimbus RAT: Java-based Remote Access Trojan Delivered via

Immediate actions

  • Isolate affected hosts and terminate all javaw.exe processes tied to suspicious JAR files
  • Remove C:\ProgramData\InboxCorePro\ and C:\ProgramData\InboxSetupPro\ directories and delete any Startup-folder launcher shortcuts
  • Delete license.txt to prevent post-reboot RAT relaunch (necessary but not sufficient on its own)
  • In Google Workspace audit logs, revoke any OAuth grant to an application named 'BackupBOX' requesting the drive scope

Workarounds

  • Disable communication with trial/external Teams tenants in the Teams admin center (would block ~65% of observed malicious messages)
  • Disable or restrict Quick Assist via policy to pre-approved helpdesk accounts only
  • Block outbound HTTPS to Pastebin from endpoints during business hours where not approved
  • Use application control to block javaw.exe execution from C:\ProgramData\ and user-writable directories

Longer-term hardening

  • Deploy EDR rules for javaw.exe running -jar payloads from C:\ProgramData\ or user-writable paths with explorer.exe as parent
  • Enable process-level attribution in proxy/firewall logs and alert on googleapis.com/docs.google.com traffic from javaw.exe or C:\ProgramData\ processes
  • Implement email-bombing detection (20+ emails/minute from diverse senders) to catch the campaign 45+ minutes before the vishing call
  • User-awareness training: internal IT never initiates contact via external Teams accounts; verify on a known helpdesk number before acting

Timeline of Nimbus RAT: Java-based Remote Access Trojan Delivered via

  • Start of eSentire TRU 12-month dataset window; baseline level of malicious external Microsoft Teams IT-helpdesk impersonation activity begins (May-Nov 2025).
  • Sharp surge in Teams-based social-engineering activity begins; Dec 2025-Mar 2026 accounts for 57% of annual volume.
  • Peak month with 408 malicious external Teams events (~8x baseline) across the customer base.
  • 18:04 UTC: second Quick Assist session attempted; eSentire MDR isolates the host, interrupting the attack before objective execution.
  • 17:59 UTC: regedit.exe imports InboxCorePro.reg, then javaw.exe executes InboxCorePro.jar - Nimbus RAT initialization (<20 min from first Teams contact).
  • 17:53-17:56 UTC: victim opens pastebin.com/G6jA0PLU checklist and downloads InboxCorePro.zip from a compromised SharePoint tenant.
  • 17:48 UTC: user launches Quick Assist from Windows Explorer; 17:52 actor runs cmd.exe 'net time /domain' reconnaissance.
  • 17:45 UTC: external Microsoft Teams contact impersonating IT helpdesk reaches the victim ~45 minutes after the bombing peak.
  • 16:00-17:30 UTC: email bombing of legal-industry victim - 282 subscription emails from 116 sender domains in ~90 minutes.
  • eSentire Threat Response Unit publishes the Nimbus RAT analysis and IOC list.

Sources cited for Nimbus RAT: Java-based Remote Access Trojan Delivered via

Threats related to Nimbus RAT: Java-based Remote Access Trojan Delivered via

Detection coverage for TL-2026-0847

As of 2026-05-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0847 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats