ACCORDING to Zscaler ThreatLabz, researchers have exposed a sophisticated cyberespionage operation that targets the Indian government and blends legitimate cloud services with artificial intelligence. The campaign, dubbed “Sheet Attack,” uses Google Sheets as a command-and-control channel, turning a normal spreadsheet tool into a weapon of war and distributing a backdoor called SHEETCREEP written in C#.
The operation appears to involve a Pakistan-linked threat actor modernising its arsenal, with tools such as FIREPOWER, a PowerShell-based backdoor that abuses Google’s Firebase, and MAILCREEP, designed to manipulate emails for exfiltration. The activity, observed between November 2025 and January 2026, also suggests that attackers are incorporating generative AI into their malware development workflow, reflecting a broader trend in cyber operations.
While the report notes similarities to APT36, it emphasises an evolution of that group or a closely aligned new threat, with concurrent activity alongside traditional APT36 operations targeting Indian government entities.