Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google Drive C2 — Threadlinqs Intelligence
As of 2026-05-28, Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google Drive C2 is a high-severity malware threat attributed to BlackSuit affiliate, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0847 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: BlackSuit affiliate · FINANCIAL
eSentire's Threat Response Unit documents Nimbus RAT, a self-contained Java RAT (internal name "BackupBOX") bundling its own OpenJDK 25 runtime and using Google Drive/Google Sheets as an
Nimbus RAT is a Java-based remote access trojan tracked by eSentire's Threat Response Unit (TRU) following an April 6, 2026 intrusion against a legal-industry customer. The campaign is a living-off-trusted-services operation that abuses legitimate cloud platforms end to end: Microsoft Teams for initial contact, Microsoft SharePoint/OneDrive for payload staging, Pastebin for human-readable installation instructions, and Google Drive plus Google Sheets for command-and-control and exfiltration.
The intrusion begins with an email-bombing phase (282 subscription-confirmation emails from 116 sender domains over ~90 minutes), which manufactures urgency and sets up a follow-up Microsoft Teams contact from an external tenant impersonating internal IT support. Roughly 45 minutes after the bombing peak, the actor reaches the victim over Teams, persuades them to launch Windows Quick Assist, performs reconnaissance via cmd.exe (net time /domain), and directs the user to a Pastebin checklist (pastebin.com/G6jA0PLU). The checklist instructs the victim to download InboxCorePro.zip from a compromised SharePoint tenant, import InboxCorePro.reg via regedit, and execute InboxCorePro.jar with javaw.exe. From first Teams contact to RAT execution elapsed under 20 minutes.
Nimbus RAT (internal identifier "BackupBOX", campaign UUID 1hc1his4gmto0q1, entry class Goferindubitably.Audiometric) ships a full OpenJDK 25.0.1 runtime so it runs regardless of host Java state, and is obfuscated with randomized English-word package names. On launch it creates a single-instance lock at %TEMP%\java_app.lock, registers a JVM shutdown hook, verifies its configuration against an embedded 4096-bit RSA public key, and enforces a license.txt kill switch (exiting via System.exit(0) if absent). It then enters a priority-based C2 polling loop. Command and control runs over the Google Drive API using either a ServiceAccountCredentials JSON key channel ("Keenplainspokenness"), an OAuth2 refresh-token channel ("Intervention") under an OAuth application named "BackupBOX" requesting the drive scope, or a cert-validation-disabled channel ("phonemicsVandalism"). Command files are named entry_{UUID}, responses exit_{UUID}, and config updates newconfig_{prefix}; all payloads are RSA-4096 signed/encrypted and chunked. Normal polling is 30-75s, droppable to a 4-8s "wakeup" cadence for up to 10 minutes. Because all traffic resolves to googleapis.com/docs.google.com, network-layer blocking is impractical and detection must be process-behavioral.
Capabilities include arbitrary command execution, full registry access (HKLM/HKCU/HKCR/HKU/HKCC via Advapi32Util), file system manipulation, screenshot capture, network/adapter enumeration via JNA (GetAdaptersInfo/GetNetworkParams), credential theft through both fake Java Swing dialogs (lf) and native Windows CredUIPromptForCredentialsW prompts (cf), window-focus theft (SetForegroundWindow/AttachThreadInput), and in-memory compilation/execution of attacker-supplied Java source (jc/jcb commands) with no disk writes via javax.tools.JavaCompiler and a HashMap-backed MemoryClassLoader. Persistence is operator-driven rather than autonomous: a pre-staged InboxCorePro.reg run key and Startup-folder launcher mean infection does not survive reboot if the host is isolated before the operator acts. A distinct second-stage tool, InboxSetupPro (C:\ProgramData\InboxSetupPro\), exfiltrates over OneDrive and was observed staging a 1.13 GB archive targeting Signal Desktop attachments and Outlook OST data.
Across a May 2025-May 2026 dataset, eSentire observed 1,540 malicious external Teams interactions across 172 organizations, peaking in February 2026 (408 events, ~8x baseline). 65% of messages came from throwaway *.onmicrosoft.com tenants (235 unique), 49% used IT/helpdesk impersonation, and 80% originated from hosting/datacenter ASNs with cross-customer IP and tenant reuse. eSentire and Rapid7 associate the activity with BlackSuit affiliates (a Black Basta
Target sectors: legal, professional services, technology, financial
Target regions: North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1589, T1583, T1583, T1585, T1586, T1566, T1199, T1204, T1204, T1204