Elastic detects stealthy NANOREMOTE malware using Google Drive as C2

Elastic Security Labs researchers uncovered NANOREMOTE, a new Windows backdoor that uses the Google Drive API for C2, and they note it shares code with the FINALDRAFT (Squidoor) implant linked to threat group REF7707. According to Elastic, one of the malware’s primary features is shipping data back and forth from the victim endpoint via the Google Drive API, creating a covert data theft and payload staging channel.

The sample uses WMLOADER, a loader masquerading as a Bitdefender executable with an invalid signature, to prepare for shellcode execution, and the shellcode decrypts a log file with AES-CBC using a fixed key before loading NANOREMOTE into memory. NANOREMOTE itself is a 64‑bit backdoor written in C++ that can run commands, move files and use the Google Drive API for data transfers, with 22 command handlers and capabilities to load PE files from disk or memory and manage directories.

Communications with a hard-coded non-routable IP occur over HTTP, with JSON data POSTed after Zlib compression and AES-CBC encryption using a 16-byte key, and the URI used is /api/client with a NanoRemote/1.0 User-Agent.