Seqrite Details Operation ShadowRecruit Targeting Indian Job Seekers
Summary
Seqrite researchers detail a multi-stage campaign targeting Indian government job seekers with a fake recruitment lure, ControlR remote access, and a .NET RAT using Google Sheets and Drive for command-and-control. They assess an APT36 link with moderate confidence.
Key points
- A fake Cabinet Secretariat recruitment notice was used to lure Indian government job seekers into opening a ZIP archive containing a malicious LNK, PowerShell script, and .NET executable.
- The LNK launched a hidden PowerShell script that downloaded and installed the legitimate ControlR agent, enrolling the victim machine in an attacker-controlled instance.
- The .NET dropper established persistence with a scheduled task that ran every three minutes, with a Windows Startup folder shortcut as a fallback.
- The final payload, named SheetAgent RAT, used hardcoded Google service-account credentials to access Google Sheets and Drive as a backup command-and-control channel.
- The RAT read attacker commands from a spreadsheet, executed them on infected machines, and wrote results and system details back to the spreadsheet.
- The malware checked for virtual machines and analysis environments; if detected, it ran a cleanup routine that deleted the malware and configuration file.
- Seqrite assessed a likely APT36 connection with moderate confidence, citing the targeting and tradecraft and similarities to a Zscaler ThreatLabz report.
Article Details
- Attack Vectors
- A fake Cabinet Secretariat recruitment notice was used to lure Indian government job seekers into opening a ZIP archive containing a malicious LNK, a hidden PowerShell script, and a .NET executable.
- The LNK used a Microsoft Edge icon and launched PowerShell, which decoded an embedded Base64 command and downloaded the ControlR Agent Installer.
- The installer enrolled victim machines in the attackers’ ControlR instance for remote access. Document.exe then dropped SheetAgent RAT and a decoy-document shortcut.
- Persistence used a scheduled task configured to run at login and every three minutes, with a Startup-folder shortcut as a fallback.
- SheetAgent RAT used hardcoded Google service-account credentials to access Google Sheets and Drive as a backup command-and-control channel, reading commands and writing execution results and victim information.
- SheetAgent RAT checked for virtualization and sandbox artifacts and, upon detection, ran a cleanup routine that deleted the malware executable and configuration file.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
otp[.]applyanyjob@gmail[.]com | Gmail account linked to the campaign's Google Workspace infrastructure and listed as owner of its Data folder. | |
service@sheet12-500308[.]iam[.]gserviceaccount[.]com | Hardcoded service account used by SheetAgent RAT to access the campaign's Google Sheets and Drive resources. | |
| IPV4 | 38[.]242[.]157[.]89 | Attacker-associated server used to host the decoy PDF and web-based management panels. |
| SHA256 | 2b33b5185e93e1655eb27dbaa025d7ee088627db3d640fe4709be705646b189c | SHA-256 hash of the ZIP archive containing the campaign's malicious files. |
| SHA256 | 434243e615b93a1b948c26ad55902bd78f9fa18e42375c15790634375c1ad3f4 | SHA-256 hash of the malicious LNK file used to start the infection chain. |
| SHA256 | 70fe7576f20f5dd6a3d872753c922f1394d91487f5eabb417b240b83c22e31b2 | SHA-256 hash of JT-agenda.ps1, the campaign's PowerShell script. |
| SHA256 | b928e523b51187b932e48a65d36ce3d0c39ee9d409d493b90f98cf3d1e0e73b0 | SHA-256 hash of MicrosoftSyncService.exe, the renamed SheetAgent RAT payload. |
| SHA256 | c4859db541b2bd0d266bbc44fafb5a767c862a57a3633a949dfaeebdf88ed529 | SHA-256 hash of Document.lnk, the dropped shortcut used to display the decoy document. |
| SHA256 | ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210 | SHA-256 hash of Document.exe, the campaign's .NET dropper. |
| URL | hxxp[:]//38[.]242[.]157[.]89/file.pdf | Decoy PDF download URL hosted on the campaign's attacker-associated server. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe LNK used a Microsoft Edge icon, and malware filenames and directory names were made to resemble legitimate Windows components.T1041 · Exfiltration Over C2 ChannelSheetAgent RAT wrote command execution results and victim information to the Google Sheets C2 document.T1053.005 · Scheduled TaskDocument.exe created WindowsDefenderSyncService to launch agent.exe at login and every three minutes thereafter.T1059.001 · PowerShellThe LNK launched PowerShell, which ran JT-agenda.ps1 and its embedded command.T1070.004 · File DeletionOn detecting an analysis environment, the cleanup routine deleted the malware executable, its configuration file, and the temporary batch file.T1082 · System Information DiscoveryThe malware queried system information including manufacturer and BIOS data using WMI, and checked drivers, processes, and registry artifacts.T1105 · Ingress Tool TransferThe PowerShell script downloaded the ControlR Agent Installer, and a dropped shortcut downloaded the decoy PDF from the campaign server.T1140 · Deobfuscate/Decode Files or InformationJT-agenda.ps1 used a Base64-encoded PowerShell command that was decoded before execution.T1204.002 · Malicious FileThe infection chain began when the victim opened the disguised LNK file from the archive.T1497.001 · System ChecksSheetAgent RAT checked for virtualization and sandbox artifacts, including VM hardware, processes, registry entries, drivers, and analysis-environment artifacts.T1547.001 · Registry Run Keys / Startup FolderIf scheduled-task creation failed, the malware placed a shortcut to agent.exe in the user's Startup folder.T1564.001 · Hidden Files and DirectoriesDocument.exe and JT-agenda.ps1 were marked hidden in the archive, and the dropped agent.exe was hidden.T1566.001 · Spearphishing AttachmentThe campaign used a recruitment-themed lure and a ZIP attachment containing malicious files to target Indian government job seekers.T1614.001 · System Language DiscoverySheetAgent RAT recorded the victim's public IP address in its Google Sheets C2 row.
Threat Actors
Malware
Products
Google DriveThe attack abuses ControlR and Google Sheets/Google Drive for remote access and backup command-and-control, and is assessed with moderate confidence to be linked to APT36.Google SheetsThe attack abuses ControlR and Google Sheets/Google Drive for remote access and backup command-and-control, and is assessed with moderate confidence to be linked to APT36.
Tools
ControlRThe attack abuses ControlR and Google Sheets/Google Drive for remote access and backup command-and-control, and is assessed with moderate confidence to be linked to APT36.Detect It EasyOur initial analysis of Document.exe on Detect It Easy(DIE) showed that it is a 32-bit .NET executable.dnSpyWe further analyzed the binary using dnSpy to understand the functionality.