Skip to navigation

Threat reportMalwareTL-2026-0847

Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google Drive C2

highACTIVE

eSentire's Threat Response Unit documents Nimbus RAT, a self-contained Java RAT (internal name "BackupBOX") bundling its own OpenJDK 25 runtime and using Google Drive/Google Sheets as an RSA-4096-encrypted command-and-control channel. Operators chain email bombing, Microsoft Teams IT-helpdesk vishing, and Quick Assist remote control to reach RAT execution in under 20 minutes, with activity linked to BlackSuit/Storm-1811 ransomware affiliates.

Key facts for Nimbus RAT Google Sheets C2

IdentifiersTL-2026-0847
Also known asBackupBOX, Nimbus RAT
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows endpoints with Quick Assist enabled; Microsoft Microsoft Teams (external federation enabled); Google Google Workspace (Drive/Sheets used as C2)
AttributionBlackSuit affiliate (medium confidence)
ToolsBackupBOX
MITRE ATT&CK techniquesT1005 Data from Local System, T1010 Application Window Discovery, T1016 System Network Configuration Discovery, T1020 Automated Exfiltration, T1027 Obfuscated Files or Information, T1030 Data Transfer Size Limits, T1036 Masquerading, T1056 Input Capture, T1059 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1087 Account Discovery, T1102 Web Service and 19 more in the attack flow
MotivationFINANCIAL
Target sectorslegal, professional services, technology, financial
Target regionsNorth America, Europe
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for Nimbus RAT Google Sheets C2

As of 2026-05-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0847 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Nimbus RAT javaw.exe Launch from ProgramData/User-Writable Path — Exploitation

Detects the Nimbus RAT execution trigger: a javaw.exe (bundled OpenJDK 25 runtime shipped with the RAT) running a -jar payload from C:\ProgramData\ or a user-writable path with explorer.exe as the parent process. This is the masquerade-from-non-standard-location moment (InboxCorePro.jar) that follows the Quick Assist hand-off. Legitimate Java rarely runs javaw with -jar out of ProgramData under explorer.exe, making this a high-fidelity initial-execution signal.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1036.005
  • Data sources: sysmon, windows_security, edr_process_events
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\javaw.exe" CommandLine="*-jar*"
| where (like(Image,"%\\ProgramData\\%") OR like(Image,"%\\AppData\\%") OR like(CommandLine,"%\\ProgramData\\%") OR like(CommandLine,"%\\AppData\\%"))
| eval parent=lower(ParentImage)
| where like(parent,"%\\explorer.exe") OR like(parent,"%\\quickassist.exe") OR like(parent,"%\\sihost.exe")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(CommandLine) as cmdlines values(ParentImage) as parents by Computer, User, Image
| eval firstSeen=strftime(firstSeen,"%Y-%m-%d %H:%M:%S")
| table Computer User Image parents cmdlines count firstSeen lastSeen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "javaw.exe"
| where ProcessCommandLine has "-jar"
| where FolderPath has_any (@"\ProgramData\", @"\AppData\") or ProcessCommandLine has_any (@"\ProgramData\", @"\AppData\")
| where InitiatingProcessFileName in~ ("explorer.exe", "quickassist.exe", "sihost.exe")
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Nimbus RAT javaw.exe Execution from ProgramData or AppData (Run-Key Masquerade)
id: 5b7e4d22-3a1c-4f88-9a0d-2f1c6e0a8c41
status: experimental
description: Detects javaw.exe running a -jar payload from ProgramData or a user-writable path with a shell/Quick Assist parent, matching the Nimbus RAT (BackupBOX) execution trigger.
references:
    - https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-18
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036.005
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\javaw.exe'
        CommandLine|contains: '-jar'
        Image|contains:
            - '\ProgramData\'
            - '\AppData\'
    parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\quickassist.exe'
            - '\sihost.exe'
    condition: selection and parent
falsepositives:
    - Internally packaged Java line-of-business apps installed under ProgramData and launched from Explorer
level: high

Known false positives:

  • Internally packaged Java LOB applications installed under ProgramData and launched from Explorer
  • Software updaters that relaunch bundled JREs from AppData

Tuning notes: Allowlist known-good ProgramData JAR paths and signed internal JREs by hash. Tighten by requiring the same directory to also contain a license.txt/idegugfbptku.txt artifact for higher confidence.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Nimbus RAT Quick Assist Session Recon — Exploitation (Initial Access Hand-off) · unlock with TL Creds
  • Nimbus RAT Fake Credential Prompt + java_app.lock — Post-Exploitation Credential Access · unlock with TL Creds
  • Nimbus RAT In-Memory Java Compilation (jc/jcb) — Post-Exploitation Fileless Execution · unlock with TL Creds
  • Nimbus RAT [indicator] Masquerade Launch — Exploitation · unlock with TL Creds
  • Nimbus RAT Run-Key Import Immediately Preceding Java Execution — Post-Exploitation Persistence · unlock with TL Creds
  • Nimbus RAT BackupBOX OAuth Drive Grant + entry_/exit_ Beacon — C2/Lateral · unlock with TL Creds
  • Nimbus RAT Quick Assist Recon + regedit Run-Key Import — Post-Exploitation Persistence · unlock with TL Creds
  • Nimbus RAT Process-Attributed Google Drive C2 Beacon — C2/Exfil · unlock with TL Creds

Indicators of compromise for Nimbus RAT Google Sheets C2

As of 2026-05-28, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-0847.

Sample indicators (3 of 30)

  • Domain: googleapis[.]com
  • URL: hxxps://pastebin[.]com/G6jA0PLU
  • File hash: 9E5B1E10AD6904D3F5B48D38470CD57263974640A27D13CF793EF026D3D6B886

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

How Nimbus RAT Google Sheets C2 works

Nimbus RAT is a Java-based remote access trojan tracked by eSentire's Threat Response Unit (TRU) following an April 6, 2026 intrusion against a legal-industry customer. The campaign is a living-off-trusted-services operation that abuses legitimate cloud platforms end to end: Microsoft Teams for initial contact, Microsoft SharePoint/OneDrive for payload staging, Pastebin for human-readable installation instructions, and Google Drive plus Google Sheets for command-and-control and exfiltration.

The intrusion begins with an email-bombing phase (282 subscription-confirmation emails from 116 sender domains over ~90 minutes), which manufactures urgency and sets up a follow-up Microsoft Teams contact from an external tenant impersonating internal IT support. Roughly 45 minutes after the bombing peak, the actor reaches the victim over Teams, persuades them to launch Windows Quick Assist, performs reconnaissance via cmd.exe (net time /domain), and directs the user to a Pastebin checklist (pastebin.com/G6jA0PLU). The checklist instructs the victim to download InboxCorePro.zip from a compromised SharePoint tenant, import InboxCorePro.reg via regedit, and execute InboxCorePro.jar with javaw.exe. From first Teams contact to RAT execution elapsed under 20 minutes.

Nimbus RAT (internal identifier "BackupBOX", campaign UUID 1hc1his4gmto0q1, entry class Goferindubitably.Audiometric) ships a full OpenJDK 25.0.1 runtime so it runs regardless of host Java state, and is obfuscated with randomized English-word package names. On launch it creates a single-instance lock at %TEMP%\java_app.lock, registers a JVM shutdown hook, verifies its configuration against an embedded 4096-bit RSA public key, and enforces a license.txt kill switch (exiting via System.exit(0) if absent). It then enters a priority-based C2 polling loop. Command and control runs over the Google Drive API using either a ServiceAccountCredentials JSON key channel ("Keenplainspokenness"), an OAuth2 refresh-token channel ("Intervention") under an OAuth application named "BackupBOX" requesting the drive scope, or a cert-validation-disabled channel ("phonemicsVandalism"). Command files are named entry_{UUID}, responses exit_{UUID}, and config updates newconfig_{prefix}; all payloads are RSA-4096 signed/encrypted and chunked. Normal polling is 30-75s, droppable to a 4-8s "wakeup" cadence for up to 10 minutes. Because all traffic resolves to googleapis.com/docs.google.com, network-layer blocking is impractical and detection must be process-behavioral.

Capabilities include arbitrary command execution, full registry access (HKLM/HKCU/HKCR/HKU/HKCC via Advapi32Util), file system manipulation, screenshot capture, network/adapter enumeration via JNA (GetAdaptersInfo/GetNetworkParams), credential theft through both fake Java Swing dialogs (lf) and native Windows CredUIPromptForCredentialsW prompts (cf), window-focus theft (SetForegroundWindow/AttachThreadInput), and in-memory compilation/execution of attacker-supplied Java source (jc/jcb commands) with no disk writes via javax.tools.JavaCompiler and a HashMap-backed MemoryClassLoader. Persistence is operator-driven rather than autonomous: a pre-staged InboxCorePro.reg run key and Startup-folder launcher mean infection does not survive reboot if the host is isolated before the operator acts. A distinct second-stage tool, InboxSetupPro (C:\ProgramData\InboxSetupPro\), exfiltrates over OneDrive and was observed staging a 1.13 GB archive targeting Signal Desktop attachments and Outlook OST data.

Across a May 2025-May 2026 dataset, eSentire observed 1,540 malicious external Teams interactions across 172 organizations, peaking in February 2026 (408 events, ~8x baseline). 65% of messages came from throwaway *.onmicrosoft.com tenants (235 unique), 49% used IT/helpdesk impersonation, and 80% originated from hosting/datacenter ASNs with cross-customer IP and tenant reuse. eSentire and Rapid7 associate the activity with BlackSuit affiliates (a Black Basta successor) and Storm-1811/3AM-aligned ransomware operations.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture

Discovery

T1010 Application Window Discovery; T1016 System Network Configuration Discovery; T1087 Account Discovery; T1124 System Time Discovery; T1538 Cloud Service Dashboard

Exfiltration

T1020 Automated Exfiltration; T1030 Data Transfer Size Limits; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Credential Access

T1056 Input Capture; T1110 Brute Force

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1132 Data Encoding; T1219 Remote Access Tools; T1573 Encrypted Channel

Initial Access

T1199 Trusted Relationship; T1566 Phishing

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts

Reconnaissance

T1589 Gather Victim Identity Information

Remediation for Nimbus RAT Google Sheets C2

Immediate actions

  • Isolate affected hosts and terminate all javaw.exe processes tied to suspicious JAR files
  • Remove C:\ProgramData\InboxCorePro\ and C:\ProgramData\InboxSetupPro\ directories and delete any Startup-folder launcher shortcuts
  • Delete license.txt to prevent post-reboot RAT relaunch (necessary but not sufficient on its own)
  • In Google Workspace audit logs, revoke any OAuth grant to an application named 'BackupBOX' requesting the drive scope

Workarounds

  • Disable communication with trial/external Teams tenants in the Teams admin center (would block ~65% of observed malicious messages)
  • Disable or restrict Quick Assist via policy to pre-approved helpdesk accounts only
  • Block outbound HTTPS to Pastebin from endpoints during business hours where not approved
  • Use application control to block javaw.exe execution from C:\ProgramData\ and user-writable directories

Longer-term hardening

  • Deploy EDR rules for javaw.exe running -jar payloads from C:\ProgramData\ or user-writable paths with explorer.exe as parent
  • Enable process-level attribution in proxy/firewall logs and alert on googleapis.com/docs.google.com traffic from javaw.exe or C:\ProgramData\ processes
  • Implement email-bombing detection (20+ emails/minute from diverse senders) to catch the campaign 45+ minutes before the vishing call
  • User-awareness training: internal IT never initiates contact via external Teams accounts; verify on a known helpdesk number before acting

Affected and fixed versions

  • Microsoft — Windows endpoints with Quick Assist enabled
    Vulnerable versions: Windows 10; Windows 11
  • Microsoft — Microsoft Teams (external federation enabled)
    Vulnerable versions: Teams with unrestricted external/trial-tenant messaging
  • Google — Google Workspace (Drive/Sheets used as C2)
    Vulnerable versions: Workspace tenants without OAuth app governance

Timeline of Nimbus RAT Google Sheets C2

  • Start of eSentire TRU 12-month dataset window; baseline level of malicious external Microsoft Teams IT-helpdesk impersonation activity begins (May-Nov 2025).
  • Sharp surge in Teams-based social-engineering activity begins; Dec 2025-Mar 2026 accounts for 57% of annual volume.
  • Peak month with 408 malicious external Teams events (~8x baseline) across the customer base.
  • 18:04 UTC: second Quick Assist session attempted; eSentire MDR isolates the host, interrupting the attack before objective execution.
  • 17:59 UTC: regedit.exe imports locked-ioc-23, then javaw.exe executes locked-ioc-22 - Nimbus RAT initialization (<20 min from first Teams contact).
  • 17:53-17:56 UTC: victim opens pastebin.com/G6jA0PLU checklist and downloads locked-ioc-21 from a compromised SharePoint tenant.
  • 17:48 UTC: user launches Quick Assist from Windows Explorer; 17:52 actor runs cmd.exe 'net time /domain' reconnaissance.
  • 17:45 UTC: external Microsoft Teams contact impersonating IT helpdesk reaches the victim ~45 minutes after the bombing peak.
  • 16:00-17:30 UTC: email bombing of legal-industry victim - 282 subscription emails from 116 sender domains in ~90 minutes.
  • eSentire Threat Response Unit publishes the Nimbus RAT analysis and IOC list.

Sources cited for Nimbus RAT Google Sheets C2

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats