Sheet Attack Campaign Targets Indian Government With Three Backdoors and Cloud-Based C2
Summary
Zscaler details the Sheet Attack campaign targeting Indian government entities with SHEETCREEP, FIREPOWER and MAILCREEP backdoors, malicious PDFs and LNK files, and command-and-control over legitimate Google and Microsoft services.
Key points
- PDF lures and malicious LNK files are used to deliver backdoors to targets in India.
- SHEETCREEP is a C# backdoor that uses Google Sheets for command-and-control.
- FIREPOWER is a PowerShell backdoor that uses Firebase to receive commands, download files, and collect directory listings.
- MAILCREEP uses Microsoft Graph API and a threat-actor-controlled Azure mailbox for command-and-control.
- A PowerShell document stealer searches Desktop, Documents, and OneDrive for selected file types and uploads them to a private GitHub repository.
- ThreatLabz found indicators suggesting generative AI contributed to some malware code, but also observed signs of manual development and operator activity.
- The campaign was active at the time of the report; ThreatLabz assesses it may involve a new or parallel Pakistan-linked group with similarities to APT36.
Article Details
- Attack Vectors
- PDF lures prompted recipients to click a download button that led to a threat actor-controlled website serving a ZIP archive containing SHEETCREEP.
- Malicious LNK files delivered FIREPOWER and executed PowerShell commands that retrieved scripts from threat actor-controlled infrastructure.
- FIREPOWER could download files and execute commands received through its Firebase C2 channel.
- A PowerShell document stealer collected selected file types from victims’ Desktop, Documents, and OneDrive directories and uploaded them to a threat actor-controlled private GitHub repository.
- MAILCREEP used email folders and messages in a threat actor-controlled Azure tenant to receive commands.
- Defensive Notes
- Monitor for malicious PDF and LNK delivery, including PowerShell execution and scheduled-task persistence.
- Inspect unusual endpoint communications with Google Sheets, Firebase Realtime Database, Microsoft Graph API, and attacker-controlled cloud tenants for C2 activity.
- Monitor for unauthorized collection of documents and uploads to private GitHub repositories.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | coadelhi[.]in | Domain listed as payload-hosting infrastructure for the campaign. |
| DOMAIN | hciaccounts[.]in | Payload-hosting domain used to distribute the SHEETCREEP archive. |
| DOMAIN | hcidelhi[.]in | Domain listed as payload-hosting infrastructure for the campaign. |
| DOMAIN | hcidoc[.]in | Threat actor-controlled domain used to serve FIREPOWER PowerShell commands. |
| DOMAIN | hcisupport[.]in | Domain listed as payload-hosting infrastructure for the campaign. |
| IPV4 | 15[.]207[.]85[.]170 | Download IP address listed for hciaccounts[.]in payload delivery. |
| MD5 | 03141afe5c20d37620c085cdbeb4058b | Hash of a reconstructed SHEETCREEP dropper .NET binary. |
| MD5 | 0729db72ab4ad9b2ac7a82918c744388 | Hash of the Proof.png SHEETCREEP artifact. |
| MD5 | 0f7730a78490c61964b3bfc05eb59ea7 | Hash of a FIREPOWER artifact. |
| MD5 | 119b836b4e1e7be8c3be8fe921f72bfb | Hash of a FIREPOWER artifact. |
| MD5 | 12669c29e00057abf20c73a434eb3dd2 | Hash of a FIREPOWER artifact. |
| MD5 | 1ede39cb02b8aaa75063febc167db565 | Hash of Pay.pdf, identified as a phishing PDF. |
| MD5 | 21dacb6cf6da872f1f3c7b6c876a8a92 | Hash of the AttachmentLetter.LNK dropper launcher. |
| MD5 | 41a3752e6ea83d25731f22e1c17f59e2 | Hash of a FIREPOWER artifact. |
| MD5 | 5001c32b386cc8346079db7b2629d777 | Hash of d.exe, a SHEETCREEP and MAILCREEP dropper launcher. |
| MD5 | 556a567a2c5c27a6aa5660e2e6bcce7b | Hash of the detail.png SHEETCREEP artifact. |
| MD5 | 62a23220b0249a15503f5ad762ed5889 | Hash of the GServices.vbs loader. |
| MD5 | 6bed5e271eddf5cb86a5964b8c2f51b6 | Hash of Document.zip, an archive containing the SHEETCREEP payload. |
| MD5 | 7269779e3fe07b1d96564117461ec75b | Hash of chrome.exe identified as a SHEETCREEP dropper launcher. |
| MD5 | 87c7d69c6131406afdd0a08e89329d0a | Hash of the details.png artifact identified as SHEETCREEP. |
| MD5 | a0b6869accba2c9ad3e1f79268a810d4 | Hash of the PowerShell document stealer. |
| MD5 | cd5aab2b0f8d2b42e7a6537303d6345d | Hash of a FIREPOWER artifact. |
| MD5 | e48f1000c86b93cf428a13a0b7384e0d | Hash of a FIREPOWER artifact. |
| MD5 | ed4dd29c57a38f2bb1934acbaeadeeba | Hash of the ds.png MAILCREEP artifact. |
| MD5 | f9a2da8f12179414663a230f11edca20 | Hash of the edge.exe SHEETCREEP artifact. |
| SHA1 | 147055a1341737625cf0e878b7ebd5acf09d1883 | Hash of chrome.exe identified as a SHEETCREEP dropper launcher. |
| SHA1 | 16410fe2c44272005ca3c2ce994d24e9c2e731f6 | Hash of Document.zip, an archive containing the SHEETCREEP payload. |
| SHA1 | 2f46595d58bef1c70ca757e18bb04443b2d5ce72 | Hash of the AttachmentLetter.LNK dropper launcher. |
| SHA1 | 6140ed17fa47e0fa166449eaf2b2770fec0fedbd | Hash of the PowerShell document stealer. |
| SHA1 | 7bc5d288ec260765a146136194d815ff3c697df8 | Hash of the ds.png MAILCREEP artifact. |
| SHA1 | 8735e1af5134d1cd173b55b089e31becb0261677 | Hash of d.exe, a SHEETCREEP and MAILCREEP dropper launcher. |
| SHA1 | 8f9843607ff0ed83ca58e21612b41d6e744beb81 | Hash of a FIREPOWER artifact. |
| SHA1 | 97712c11b83c31ba03b747cf39a49cd0e208c5f5 | Hash of Pay.pdf, identified as a phishing PDF. |
| SHA1 | a38eab1ac01201b651b2efdebc78e994402976f1 | Hash of a FIREPOWER artifact. |
| SHA1 | a55c18a82203cf1efafac6f3c47642ab60c74ffc | Hash of the details.png artifact identified as SHEETCREEP. |
| SHA1 | aa9b4410004d43e4e5cc1fc2cda1956bc5663b03 | Hash of a FIREPOWER artifact. |
| SHA1 | ac06003a774af5a8e4be349fc6f0e65cea116370 | Hash of a FIREPOWER artifact. |
| SHA1 | b8fd6b4eece68095caeb26bdd1090ab7959f24aa | Hash of a reconstructed SHEETCREEP dropper .NET binary. |
| SHA1 | cdecfe8e1cacd1af204a5da52f6c02eb16fdea8b | Hash of the edge.exe SHEETCREEP artifact. |
| SHA1 | daeeb031a9617e6f1b7bf4d85de9c75f62021c82 | Hash of the Proof.png SHEETCREEP artifact. |
| SHA1 | e333ae0948ede0cf1368deec53a1eda18210e75e | Hash of a FIREPOWER artifact. |
| SHA1 | e9d9d8c0c818ba9208e61eaf49af4c1b37f4eb59 | Hash of the detail.png SHEETCREEP artifact. |
| SHA1 | e9eeda092500d7c7f278672d35f733e0e26f0e2c | Hash of a FIREPOWER artifact. |
| SHA1 | f68cd104bfa2ac9992a98936c6e97c41e680b698 | Hash of the GServices.vbs loader. |
| SHA256 | 20d72c8580b4d5ef4f771c91ce1d1207e5416fa789d8216a73a0abb8e030644f | Hash of a FIREPOWER artifact. |
| SHA256 | 309a39ba10cd7c7075837b63d247fa45764f5496fdae215e95a3f4b65ab6dfc3 | Hash of a FIREPOWER artifact. |
| SHA256 | 363fca9534e5cb69e40330473bcbd0acc439cf81a555234eed250f65c98478e3 | Hash of Pay.pdf, identified as a phishing PDF. |
| SHA256 | 43fb05d9fc179f791b1a2814f7116ee577b6e48f62eee63af039350260d7fe2b | Hash of a reconstructed SHEETCREEP dropper .NET binary. |
| SHA256 | 59abb997927e471472a1c487dea0180d11e9c99774bb138ace46771acba9c3d8 | Hash of Document.zip, an archive containing the SHEETCREEP payload. |
| SHA256 | 61b2b6b61474398a966e26d3b909542450fcab9b6670558cecd6fabc1015bbce | Hash of d.exe, a SHEETCREEP and MAILCREEP dropper launcher. |
| SHA256 | 644dda0ea5db1eb5f07ccfccddb909c6ee57235c4465adbfc342da6867cdb71a | Hash of a FIREPOWER artifact. |
| SHA256 | 71794df37a107472e8d0829387741953f9e6c7778519b11f061c79ff6fb0f386 | Hash of the Proof.png SHEETCREEP artifact. |
| SHA256 | 86d8b3fe209b3f1d9a20865ff1ee5d6015941c2a5394861118c8d6ec3695f1a6 | Hash of the PowerShell document stealer. |
| SHA256 | 889b4b1e13b66aff349282eae3999783f5542f961b433a7d4653c5281e7f4d3e | Hash of a FIREPOWER artifact. |
| SHA256 | 989ad43bb9e328d786664247c3af4c17be28932760113708a9c6de977d69652c | Hash of a FIREPOWER artifact. |
| SHA256 | 9ab6d01a6df367ee505e59850438e6926dfb61c2ebfbe4e03eba48f70ee36ac3 | Hash of the GServices.vbs loader. |
| SHA256 | 9eebbf8899a1cf4156a872e9b8cde2a8f6ab364b8089550510938405c622cc58 | Hash of the edge.exe SHEETCREEP artifact. |
| SHA256 | a97cc81a2f7c05bfc498b71999176c2aeb6e3ad273e48eb1f5c1c5647419c642 | Hash of the ds.png MAILCREEP artifact. |
| SHA256 | b56062033df06738b66c38b3fa2f82a7e8c558336a4790c83c7faad595172167 | Hash of the details.png artifact identified as SHEETCREEP. |
| SHA256 | bb11bea463ab1b976c3716591f93eccc71c1a2d1c389a371416b140cd8faa6f0 | Hash of the detail.png SHEETCREEP artifact. |
| SHA256 | bec00fa5a87195f182511ecc5292a716c79bc74e17bd1138c8fb2f2285df1b46 | Hash of the AttachmentLetter.LNK dropper launcher. |
| SHA256 | de14ca6d93dadbc1ec216700d76ad2d0e7b9ebceb95de68c631d0a1c01c915c4 | Hash of a FIREPOWER artifact. |
| SHA256 | eea5cb7795d86e4612edcc6f0085d151e1b7a7351646caf26955c2ac35158971 | Hash of chrome.exe identified as a SHEETCREEP dropper launcher. |
| URL | hxxps[:]//docs[.]google[.]com/spreadsheets/d/1cB8jzFpQcixridoEz_eDvLnjCTx79gKFQSoFiuOErdM/edit | Google Sheets C2 URL used by SHEETCREEP. |
| URL | hxxps[:]//docs[.]google[.]com/spreadsheets/d/1cdSJvZ7tx6CPBuEa66uTVWmSD4zABnZOLjM87pRXkTE/edit | Google Sheets C2 URL used by SHEETCREEP. |
| URL | hxxps[:]//docs[.]google[.]com/spreadsheets/d/1wgx4gj3-YGGAwmtr1DRu4n1QkznK2pYoKO6C4GTmquY/edit | Google Sheets C2 URL used by SHEETCREEP. |
| URL | hxxps[:]//gov-service-in-default-rtdb[.]firebaseio[.]com | FIREPOWER C2 endpoint. |
| URL | hxxps[:]//govs-services-in-default-rtdb[.]firebaseio[.]com | FIREPOWER C2 endpoint. |
| URL | hxxps[:]//hciaccounts[.]in/Documents[.]zip | Payload-download URL serving the SHEETCREEP archive. |
| URL | hxxps[:]//storage[.]googleapis[.]com/testfirebase-b24a8[.]appspot[.]com/config1[.]txt | SHEETCREEP backup-configuration URL identified as an indicator. |
| URL | hxxps[:]//testfirebase-b24a8-default-rtdb[.]firebaseio[.]com/(12336)005056C0000186/details[.]json | SHEETCREEP backup-configuration URL identified as an indicator. |
| URL | hxxps[:]//webdevurl-cc389-default-rtdb[.]firebaseio[.]com | FIREPOWER C2 endpoint. |
MITRE ATT&CK
T1005 · Data from Local SystemThe PowerShell document stealer scans victim directories for selected document types.T1053.005 · Scheduled TaskThe SHEETCREEP loader and a FIREPOWER variant use scheduled tasks for persistence.T1059.001 · PowerShellFIREPOWER and the SHEETCREEP loader use PowerShell to execute commands and load the backdoor.T1059.003 · Windows Command ShellSHEETCREEP executes received commands through a hidden cmd.exe process; MAILCREEP runs commands with cmd.exe /c.T1102.002 · Bidirectional CommunicationSHEETCREEP and FIREPOWER use Google Sheets and Firebase, respectively, for C2; MAILCREEP uses Microsoft Graph email functionality for C2.T1204.002 · Malicious FileThe recipient was prompted to click the PDF download button, and malicious LNK files were used to initiate FIREPOWER delivery.T1566.001 · Spearphishing AttachmentThe campaign used a phishing PDF lure to direct recipients to download the payload.T1567.001 · Exfiltration to Code RepositoryThe document stealer uploads collected files to a threat actor-controlled private GitHub repository.
Threat Actors
Malware
FIREPOWERIn September 2025, Zscaler ThreatLabz uncovered three additional backdoors, SHEETCREEP, FIREPOWER, and MAILCREEP, used to power the Sheet Attack campaign. In Part 2 of this series, ThreatLabz will delve into theseMAILCREEPIn September 2025, Zscaler ThreatLabz uncovered three additional backdoors, SHEETCREEP, FIREPOWER, and MAILCREEP, used to power the Sheet Attack campaign. In Part 2 of this series, ThreatLabz will delve into theseSHEETCREEPIn September 2025, Zscaler ThreatLabz uncovered three additional backdoors, SHEETCREEP, FIREPOWER, and MAILCREEP, used to power the Sheet Attack campaign. In Part 2 of this series, ThreatLabz will delve into these
Vendors
GoogleThe Sheet Attack campaign stands out for its use of Google Sheets as a command-and-control (C2) channel, an uncommon tactic in this region. Between November 2025 and January 2026, ThreatLabz observed the deployment ofMicrosoftbackdoors that utilized multiple C2 channels that abused legitimate cloud services from Google and Microsoft, enabling the network traffic to blend in and evade security controls.
Products
AzureMicrosoft's Graph API to manipulate emails and folders for C2 activity within a threat actor-controlled Azure tenant. For each victim, MAILCREEP creates a folder in the mailbox using the victim's identifierFirebase Realtime DatabaseFIREPOWER is a PowerShell-based backdoor that abuses Google’s Firebase Realtime Database for its C2 channel.GitHub.xlsx, .pptx). The threat actor proceeded to upload those files to a threat actor-controlled private GitHub repository.Google SheetsThe Sheet Attack campaign stands out for its use of Google Sheets as a command-and-control (C2) channel, an uncommon tactic in this region. Between November 2025 and January 2026, ThreatLabz observed the deployment ofMicrosoft Graph APIMAILCREEP is a Golang-based backdoor leveraging the Microsoft Graph API for its C2 communications.
Countries
Indiageographic and User-Agent checks to ensure the ZIP archive was only delivered to Windows systems in India, returning a “403 Forbidden” error otherwise. These ZIP archives contained the SHEETCREEP backdoor. ThePakistanThreatLabz assesses with medium confidence that these campaigns likely originate from a new subgroup or a parallel Pakistan-linked group, despite sharing similarities with the APT36 threat group.