# Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google Drive C2

> eSentire's Threat Response Unit documents Nimbus RAT, a self-contained Java RAT (internal name "BackupBOX") bundling its own OpenJDK 25 runtime and using Google Drive/Google Sheets as an RSA-4096-encrypted command-and-control channel. Operators chain email bombing, Microsoft Teams IT-helpdesk vishing, and Quick Assist remote control to reach RAT execution in under 20 minutes, with activity linked to BlackSuit/Storm-1811 ransomware affiliates.

- **Published:** 2026-05-28T00:00:00Z
- **Last reviewed:** 2026-05-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0847
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-nimbus-rat-google-sheets-c2-tl-2026-0847.webp?v=b0e51255 (Threadlinqs threat intel: Nimbus RAT Java-based Trojan: Detection & IOCs (TL-2026-0847) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-0847
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** BlackSuit affiliate
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Nimbus RAT is a Java-based remote access trojan tracked by eSentire's Threat Response Unit (TRU) following an April 6, 2026 intrusion against a legal-industry customer. The campaign is a living-off-trusted-services operation that abuses legitimate cloud platforms end to end: Microsoft Teams for initial contact, Microsoft SharePoint/OneDrive for payload staging, Pastebin for human-readable installation instructions, and Google Drive plus Google Sheets for command-and-control and exfiltration.

The intrusion begins with an email-bombing phase (282 subscription-confirmation emails from 116 sender domains over ~90 minutes), which manufactures urgency and sets up a follow-up Microsoft Teams contact from an external tenant impersonating internal IT support. Roughly 45 minutes after the bombing peak, the actor reaches the victim over Teams, persuades them to launch Windows Quick Assist, performs reconnaissance via cmd.exe (net time /domain), and directs the user to a Pastebin checklist (pastebin.com/G6jA0PLU). The checklist instructs the victim to download InboxCorePro.zip from a compromised SharePoint tenant, import InboxCorePro.reg via regedit, and execute InboxCorePro.jar with javaw.exe. From first Teams contact to RAT execution elapsed under 20 minutes.

Nimbus RAT (internal identifier "BackupBOX", campaign UUID 1hc1his4gmto0q1, entry class Goferindubitably.Audiometric) ships a full OpenJDK 25.0.1 runtime so it runs regardless of host Java state, and is obfuscated with randomized English-word package names. On launch it creates a single-instance lock at %TEMP%\java_app.lock, registers a JVM shutdown hook, verifies its configuration against an embedded 4096-bit RSA public key, and enforces a license.txt kill switch (exiting via System.exit(0) if absent). It then enters a priority-based C2 polling loop. Command and control runs over the Google Drive API using either a ServiceAccountCredentials JSON key channel ("Keenplainspokenness"), an OAuth2 refresh-token channel ("Intervention") under an OAuth application named "BackupBOX" requesting the drive scope, or a cert-validation-disabled channel ("phonemicsVandalism"). Command files are named entry_{UUID}, responses exit_{UUID}, and config updates newconfig_{prefix}; all payloads are RSA-4096 signed/encrypted and chunked. Normal polling is 30-75s, droppable to a 4-8s "wakeup" cadence for up to 10 minutes. Because all traffic resolves to googleapis.com/docs.google.com, network-layer blocking is impractical and detection must be process-behavioral.

Capabilities include arbitrary command execution, full registry access (HKLM/HKCU/HKCR/HKU/HKCC via Advapi32Util), file system manipulation, screenshot capture, network/adapter enumeration via JNA (GetAdaptersInfo/GetNetworkParams), credential theft through both fake Java Swing dialogs (lf) and native Windows CredUIPromptForCredentialsW prompts (cf), window-focus theft (SetForegroundWindow/AttachThreadInput), and in-memory compilation/execution of attacker-supplied Java source (jc/jcb commands) with no disk writes via javax.tools.JavaCompiler and a HashMap-backed MemoryClassLoader. Persistence is operator-driven rather than autonomous: a pre-staged InboxCorePro.reg run key and Startup-folder launcher mean infection does not survive reboot if the host is isolated before the operator acts. A distinct second-stage tool, InboxSetupPro (C:\ProgramData\InboxSetupPro\), exfiltrates over OneDrive and was observed staging a 1.13 GB archive targeting Signal Desktop attachments and Outlook OST data.

Across a May 2025-May 2026 dataset, eSentire observed 1,540 malicious external Teams interactions across 172 organizations, peaking in February 2026 (408 events, ~8x baseline). 65% of messages came from throwaway *.onmicrosoft.com tenants (235 unique), 49% used IT/helpdesk impersonation, and 80% originated from hosting/datacenter ASNs with cross-customer IP and tenant reuse. eSentire and Rapid7 associate the activity with BlackSuit affiliates (a Black Basta successor) and Storm-1811/3AM-aligned ransomware operations.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1586 Compromise Accounts
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1056 Input Capture
- T1110 Brute Force
- T1016 System Network Configuration Discovery
- T1124 System Time Discovery
- T1087 Account Discovery
- T1010 Application Window Discovery
- T1538 Cloud Service Dashboard
- T1113 Screen Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1219 Remote Access Tools
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1030 Data Transfer Size Limits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Nimbus RAT javaw.exe Launch from ProgramData/User-Writable Path — Exploitation** (`TL-2026-0847-SPL-001`)

Detects the Nimbus RAT execution trigger: a javaw.exe (bundled OpenJDK 25 runtime shipped with the RAT) running a -jar payload from C:\ProgramData\ or a user-writable path with explorer.exe as the parent process. This is the masquerade-from-non-standard-location moment (InboxCorePro.jar) that follows the Quick Assist hand-off. Legitimate Java rarely runs javaw with -jar out of ProgramData under explorer.exe, making this a high-fidelity initial-execution signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036.005
- **Data sources:** sysmon, windows_security, edr_process_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\javaw.exe" CommandLine="*-jar*"
| where (like(Image,"%\\ProgramData\\%") OR like(Image,"%\\AppData\\%") OR like(CommandLine,"%\\ProgramData\\%") OR like(CommandLine,"%\\AppData\\%"))
| eval parent=lower(ParentImage)
| where like(parent,"%\\explorer.exe") OR like(parent,"%\\quickassist.exe") OR like(parent,"%\\sihost.exe")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(CommandLine) as cmdlines values(ParentImage) as parents by Computer, User, Image
| eval firstSeen=strftime(firstSeen,"%Y-%m-%d %H:%M:%S")
| table Computer User Image parents cmdlines count firstSeen lastSeen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "javaw.exe"
| where ProcessCommandLine has "-jar"
| where FolderPath has_any (@"\ProgramData\", @"\AppData\") or ProcessCommandLine has_any (@"\ProgramData\", @"\AppData\")
| where InitiatingProcessFileName in~ ("explorer.exe", "quickassist.exe", "sihost.exe")
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Nimbus RAT javaw.exe Execution from ProgramData or AppData (Run-Key Masquerade)
id: 5b7e4d22-3a1c-4f88-9a0d-2f1c6e0a8c41
status: experimental
description: Detects javaw.exe running a -jar payload from ProgramData or a user-writable path with a shell/Quick Assist parent, matching the Nimbus RAT (BackupBOX) execution trigger.
references:
    - https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-18
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036.005
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\javaw.exe'
        CommandLine|contains: '-jar'
        Image|contains:
            - '\ProgramData\'
            - '\AppData\'
    parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\quickassist.exe'
            - '\sihost.exe'
    condition: selection and parent
falsepositives:
    - Internally packaged Java line-of-business apps installed under ProgramData and launched from Explorer
level: high
```

**Known false positives:**

- Internally packaged Java LOB applications installed under ProgramData and launched from Explorer
- Software updaters that relaunch bundled JREs from AppData

**Tuning notes:** Allowlist known-good ProgramData JAR paths and signed internal JREs by hash. Tighten by requiring the same directory to also contain a license.txt/idegugfbptku.txt artifact for higher confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Nimbus RAT Quick Assist Session Recon — Exploitation (Initial Access Hand-off) (locked: unlock with TL Creds)
- Nimbus RAT Fake Credential Prompt + java_app.lock — Post-Exploitation Credential Access (locked: unlock with TL Creds)
- Nimbus RAT In-Memory Java Compilation (jc/jcb) — Post-Exploitation Fileless Execution (locked: unlock with TL Creds)
- Nimbus RAT [indicator] Masquerade Launch — Exploitation (locked: unlock with TL Creds)
- Nimbus RAT Run-Key Import Immediately Preceding Java Execution — Post-Exploitation Persistence (locked: unlock with TL Creds)
- Nimbus RAT BackupBOX OAuth Drive Grant + entry_/exit_ Beacon — C2/Lateral (locked: unlock with TL Creds)
- Nimbus RAT Quick Assist Recon + regedit Run-Key Import — Post-Exploitation Persistence (locked: unlock with TL Creds)
- Nimbus RAT Process-Attributed Google Drive C2 Beacon — C2/Exfil (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- Domain: `googleapis[.]com`
- URL: `hxxps://pastebin[.]com/G6jA0PLU`
- File hash: `9E5B1E10AD6904D3F5B48D38470CD57263974640A27D13CF793EF026D3D6B886`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT](https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat)
- [Nimbus RAT IOC list (nimbus_rat_iocs_05-28-2026.txt)](https://github.com/eSentire/iocs/tree/main/Nimbus%20Rat)
- [Nimbus RAT Delivered Through Microsoft Teams and Google Drive (detection guidance)](https://socprime.com/active-threats/nimbus-rat-delivered-through-microsoft-teams-and-google-drive/)
- [Microsoft Teams and Google Drive Abused to Compromise Systems Within 20 Minutes](https://cybersecuritynews.com/microsoft-teams-and-google-drive-abused/)
- [Malpedia library entry: Nimbus RAT](https://malpedia.caad.fkie.fraunhofer.de/library/dea7c31a-801c-4aea-8ee8-bae163b1cbe4/)
- [Nimbus RAT Campaign: Teams Voice Phishing to Quick Assist Java C2 via Google Drive](https://windowsnews.ai/article/nimbus-rat-campaign-teams-voice-phishing-to-quick-assist-java-c2-via-google-drive.423133)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0847