SHEETCREEP Malware Abuses Google Sheets API for Command-and-Control

Securonix reports a targeted campaign deploying SHEETCREEP, a C#.NET remote access trojan that uses Google Sheets API as a covert command-and-control channel; the campaign used a diplomatic-themed ISO with a malicious LNK to infect primarily Indian diplomatic and foreign-affairs entities, achieving 91 active spreadsheet tabs (including sandboxes and researcher labs) and employing persistence via COM-created scheduled tasks, in-process PowerShell, XOR-obfuscated configs, and embedded GCP service account credentials, with suspected (moderate confidence) attribution to APT36.