Hackers Use UAE-India Diplomatic Lure to Deliver SHEETCREEP RAT via Google Sheets

SHEETCREEP is an active espionage campaign delivering a compact .NET remote access trojan via a deceptive UAE‑India diplomatic ISO/LNK lure; the RAT persists via a scheduled task, executes PowerShell in‑process, and uses an embedded GCP service‑account to operate Google Sheets as a covert C2 channel. Securonix recovered credentials, accessed the live spreadsheet, enumerated ~91 victim tabs (including high‑confidence targets), and observed strong evasion and counter‑forensics, with attribution assessed at moderate confidence to APT36.