NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems

NANOREMOTE is a new Windows backdoor disclosed by Elastic Security Labs that uses the Google Drive API for its command-and-control channel, a design described as a data theft and payload‑staging conduit that is hard to detect. The malware, written in C++, includes 22 command handlers for gathering host information, performing file operations, running PE files, and transferring files via Google Drive, among other capabilities.

Its initial access chain reportedly involves a loader called WMLOADER that mimics a Bitdefender crash component and decrypts shellcode to launch the backdoor. Elastic notes shared code similarities with FINALDRAFT (also known as Squidoor), and there is an indication that both NANOREMOTE and FINALDRAFT may derive from the same build/development process, with a hard-coded 16‑byte AES key used across components.

An observed artifact, wmsetup.log, uploaded to VirusTotal from the Philippines on 3 October 2025, can be decrypted by WMLOADER to reveal a FINALDRAFT implant, suggesting a common threat actor; REF7707 (aka CL-STA-0049, Earth Alux, and Jewelbug) is associated with these campaigns.

According to Elastic Security Labs, the malware also communicates with a hard-coded non-routable IP address over HTTP to process operator requests, using POST requests that are zlib compressed and AES-CBC encrypted with a 16-byte key, with all requests targeting the /api/client URI and a User-Agent of NanoRemote/1.0.