New NANOREMOTE Backdoor Uses Google Drive API for Covert C2 and Links to FINALDRAFT Espionage Group

Elastic Security Labs has uncovered a sophisticated Windows backdoor, dubbed NANOREMOTE, that leverages the trusted infrastructure of Google Drive to hide its command-and-control traffic and exfiltrate data, with the infection chain first observed in October 2025. The backdoor uses OAuth 2.0 tokens to authenticate with Google and can ship data back and forth from the victim endpoint via the Google Drive API, forming a covert channel difficult for traditional security tools to detect.

The intrusion begins with a deceptive loader called WMLOADER, which masquerades as a Bitdefender crash handler named BDReinit.exe and contains a forged digital signature. NANOREMOTE is connected to REF7707 and to the FINALDRAFT espionage group, supported by shared code, including identical GUID generation and the reuse of the same AES key (3A5AD78097D944AC) to decrypt payloads.

The malware is a fully-featured C++ implant that employs libPeConv for PE loading and Microsoft Detours for API hooking, enhancing its stealth and resiliency. according to Elastic Security Labs, this signals a shared codebase and development environment between FINALDRAFT and NANOREMOTE.