Teams Vishing Campaign Deploys Nimbus RAT Using Quick Assist and Google Drive
Summary
eSentire investigated a Teams-vishing intrusion that used inbox flooding and Quick Assist to deploy Nimbus RAT. The Java malware uses Google Drive for C2 and can steal credentials; telemetry showed 1,540 suspicious Teams events across 172 customer environments.
Key points
- Attackers flooded a legal-sector victim’s mailbox with 282 emails, then impersonated IT support through Microsoft Teams and persuaded the user to launch Quick Assist.
- The victim downloaded Nimbus RAT from a compromised Microsoft 365 tenant after following instructions on Pastebin; the Java payload ran less than 20 minutes after initial Teams contact.
- Nimbus RAT uses Google Drive and Google Sheets for command and control and data exfiltration, making process-level behavioral monitoring more useful than broad network blocking.
- The malware can execute commands, collect system information and screenshots, steal credentials through fake or native Windows prompts, and run additional Java code in memory.
- eSentire found 1,540 suspicious external Teams messaging events across 172 customer environments from May 2025 to May 2026, with activity surging in early 2026.
- The campaign commonly used throwaway Microsoft 365 tenants, fresh .top domains, and hosted infrastructure; 65% of observed messages originated from onmicrosoft.com sender domains.
- eSentire isolated the affected host and recommends monitoring mailbox-flooding precursors, restricting external Teams contacts and trial tenants, and detecting suspicious Java execution and Google Drive activity.
Article Details
- Attack Vectors
- Mailbox flooding with legitimate subscription-confirmation emails was followed by Microsoft Teams voice phishing in which an actor posing as IT support persuaded the user to launch Quick Assist.
- The operator used a Pastebin checklist to guide the victim through downloading a ZIP payload from a compromised Microsoft 365 tenant and executing the Java RAT.
- Nimbus RAT used Google Drive for command delivery and data exfiltration. A separate tool, InboxSetupPro, was reported to use OneDrive for exfiltration.
- Nimbus RAT can capture credentials through a Java Swing imitation of the Windows Security prompt or the native CredUIPromptForCredentialsW prompt.
- The operator staged persistence using a Startup-folder entry and a registry import file; Nimbus RAT does not establish persistence autonomously.
- Nimbus RAT supports in-memory execution of operator-supplied Java source code.
- Defensive Notes
- Alert on anomalous mailbox volume, including sudden bursts of emails from diverse external senders, before a related Teams contact occurs.
- Restrict external Teams messaging and disable communication with trial tenants where business requirements allow; require approval for contacts from external organizations.
- Disable or restrict Quick Assist and other remote-support tools to approved helpdesk accounts.
- Monitor for javaw.exe launching unapproved JAR files, especially from C:\ProgramData\ or user-writable locations, and correlate process activity with Google API traffic.
- Alert on regedit.exe importing .reg files from C:\ProgramData\ near suspicious javaw.exe activity, and monitor for java_app.lock creation.
- Review browser history for Pastebin visits after suspected Teams vishing, and monitor OAuth grants for Drive scopes, especially grants to an application named BackupBOX.
- For remediation, terminate associated javaw.exe processes, remove the payload directory and Startup entries, and consider re-imaging because additional operator-established persistence may be present.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | helpdock[.]top | Freshly registered .top sender domain observed in the suspicious Teams messaging infrastructure. |
| DOMAIN | info-secure[.]top | Freshly registered .top sender domain observed in the suspicious Teams messaging infrastructure. |
| DOMAIN | scan-security[.]top | Domain in the suspicious .top sender cluster's recurring “scan” naming family. |
| DOMAIN | scanseq[.]top | Domain in the suspicious .top sender cluster's recurring “scan” naming family. |
| DOMAIN | serviceprohub[.]top | Freshly registered .top sender domain observed in the suspicious Teams messaging infrastructure. |
| DOMAIN | system-clean[.]top | Freshly registered .top sender domain observed in the suspicious Teams messaging infrastructure. |
| DOMAIN | updt-scansecurity[.]top | Domain in the suspicious .top sender cluster's recurring “scan” naming family. |
| SHA256 | 91e523a46f3bb860ac2e5800b7e1ec89d75a2408410b9cd25eebc17c8d7a92bc | SHA-256 of InboxCorePro.jar, the Nimbus RAT payload. |
| SHA256 | 9e5b1e10ad6904d3f5b48d38470cd57263974640a27d13cf793ef026d3d6b886 | SHA-256 of the malicious InboxCorePro.zip payload archive. |
MITRE ATT&CK
T1005 · Data from Local SystemInboxSetupPro's configuration targeted the victim's local Signal Desktop attachment store and Outlook data.T1056.002 · GUI Input CaptureNimbus RAT can capture credentials using a fake Java Swing credential dialog or the native Windows credential prompt.T1059.003 · Windows Command ShellThe operator ran reconnaissance commands through cmd.exe, including net time /domain.T1102.002 · Bidirectional CommunicationNimbus RAT used Google Drive as a bidirectional C2 channel for command delivery and responses.T1105 · Ingress Tool TransferThe victim downloaded the Nimbus RAT archive from a compromised Microsoft 365 tenant's SharePoint/OneDrive location.T1112 · Modify RegistryThe victim imported the operator-provided InboxCorePro.reg file using regedit.exe.T1114.001 · Local Email CollectionA recovered archive was reported as consistent with an exfiltrated Outlook OST file.T1204.002 · Malicious FileThe victim followed the checklist, extracted the downloaded archive, imported its registry file, and launched the Java payload.T1219 · Remote Access ToolsThe user launched Quick Assist at the operator's direction, enabling a remote-support session.T1547.001 · Registry Run Keys / Startup FolderThe operator placed a launcher in the Startup folder to run the payload at startup.T1566.004 · Spearphishing VoiceThe operator used a Microsoft Teams voice call while impersonating IT support to persuade the user to grant access.T1567.002 · Exfiltration to Cloud StorageNimbus RAT used Google Drive for data exfiltration, while the separate InboxSetupPro tool was reported to use OneDrive for exfiltration.T1620 · Reflective Code LoadingThe jc and jcb commands compile and execute operator-supplied Java code in memory through a custom class loader.
Threat Actors
Malware
BackupBOX- entry point initialization and hardcoded config valuesThe malware identifies itself internally as BackupBOX, with a campaign UUID of 1hc1his4gmto0q1 hardcoded in its configuration. All custom package and classNimbus RATTRU tracks this malware as Nimbus RAT, which Rapid7 previously documented in connection with BlackSuit affiliate activity following Black Basta's internal conflict in early 2025. Nimbus RAT is a self-contained implant
Vendors
Googlefollowing Black Basta's internal conflict in early 2025. Nimbus RAT is a self-contained implant that uses Google Drive and Google Sheets for command-and-control (C2), helping its network traffic appear benign.MicrosoftUnit (TRU) identified an intrusion targeting a customer in the legal industry. Threat actors used Microsoft Teams voice phishing (vishing) to deceive the victim into granting remote access via Quick Assist, then
Products
Google DriveBlack Basta's internal conflict in early 2025. Nimbus RAT is a self-contained implant that uses Google Drive and Google Sheets for command-and-control (C2), helping its network traffic appear benign.Google Sheetsinternal conflict in early 2025. Nimbus RAT is a self-contained implant that uses Google Drive and Google Sheets for command-and-control (C2), helping its network traffic appear benign.Google WorkspaceThis C2 design is difficult to detect at the network layer. Blocking docs.google.com or googleapis.com is not viable in most environments where Google Workspace is in use.Microsoft 365and the user was walked through launching Quick Assist and downloading a payload from a compromised Microsoft 365 tenant. From initial Teams contact to RAT execution, the attack took less than 20 minutes.Microsoft Defender for Endpointinvolved a customer in the legal industry. TRU reconstructed the full kill chain using Microsoft Defender for Endpoint process telemetry, browser download history, Microsoft 365 mail-flow records, and staticMicrosoft OneDrive(SHA-256: 9E5B1E10AD6904D3F5B48D38470CD57263974640A27D13CF793EF026D3D6B886), hosted in the personal OneDrive of arturolopez@<REDACTED>[.]com on <REDACTED>-my[.]sharepoint.com. This is a compromised, legitimateMicrosoft SharePointeffective because it abuses trusted platforms at every stage: Microsoft Teams for initial contact, Microsoft SharePoint for payload delivery, Quick Assist for remote access, Pastebin for instruction delivery, andMicrosoft TeamsUnit (TRU) identified an intrusion targeting a customer in the legal industry. Threat actors used Microsoft Teams voice phishing (vishing) to deceive the victim into granting remote access via Quick Assist, thenOpenJDKThe malware bundles its own Java runtime - The malware ships with a full OpenJDK 25.0.1 installation, making it portable across any Windows endpoint regardless of whether Java is installed.Quick Assistused Microsoft Teams voice phishing (vishing) to deceive the victim into granting remote access via Quick Assist, then deployed a Java-based remote access trojan (RAT).Signal DesktopThis pattern targets the Signal Desktop attachment store - the local cache of all files, images, and documents shared through Signal's encrypted messaging app - for a specific victim user. The recursive glob (/**)
Tools
Countries
DEsame ASNs appeared repeatedly across unrelated customer environments: NKtelecom INC (US), WorkTitans B.V. (DE), GLOBAL CONNECTIVITY SOLUTIONS LLP (DE), GTHost (US), GWY IT PTY LTD (NL), M247 Europe SRL, IPTP LTD (SG),FRwere present in 221 events (VPN) and 74 events (TOR). The geographic distribution (US, DE, NL, RU, SG, FR, UA) reflects datacenter locations rather than operator locations.NLINC (US), WorkTitans B.V. (DE), GLOBAL CONNECTIVITY SOLUTIONS LLP (DE), GTHost (US), GWY IT PTY LTD (NL), M247 Europe SRL, IPTP LTD (SG), NovoServe B.V. (NL), tzulo inc., and Miranda-Media Ltd (UA).RUflags were present in 221 events (VPN) and 74 events (TOR). The geographic distribution (US, DE, NL, RU, SG, FR, UA) reflects datacenter locations rather than operator locations.SG(DE), GLOBAL CONNECTIVITY SOLUTIONS LLP (DE), GTHost (US), GWY IT PTY LTD (NL), M247 Europe SRL, IPTP LTD (SG), NovoServe B.V. (NL), tzulo inc., and Miranda-Media Ltd (UA).UAIT PTY LTD (NL), M247 Europe SRL, IPTP LTD (SG), NovoServe B.V. (NL), tzulo inc., and Miranda-Media Ltd (UA).United StatesThe same ASNs appeared repeatedly across unrelated customer environments: NKtelecom INC (US), WorkTitans B.V. (DE), GLOBAL CONNECTIVITY SOLUTIONS LLP (DE), GTHost (US), GWY IT PTY LTD (NL), M247 Europe SRL, IPTP LTD
Industries
LegalApril 2026, eSentire's Threat Response Unit (TRU) identified an intrusion targeting a customer in the legal industry. Threat actors used Microsoft Teams voice phishing (vishing) to deceive the victim into grantingNGOsfrom legitimate, long-established organizational tenants (including schools, small businesses, and NGOs) whose Microsoft 365 environments had been compromised and then abused to send external Microsoft TeamsSchoolssubset of the activity originated from legitimate, long-established organizational tenants (including schools, small businesses, and NGOs) whose Microsoft 365 environments had been compromised and then abused toSmall businessesthe activity originated from legitimate, long-established organizational tenants (including schools, small businesses, and NGOs) whose Microsoft 365 environments had been compromised and then abused to send external