Fake GlobalProtect Installer Uses Myanmar Geofencing and Google Sheets C2

Sep 2, 2026 · Original article ↗

Summary

Researchers traced an unsigned, GlobalProtect-themed MSI through Myanmar geofencing and Google Sheets tasking to a follow-on payload. The evidence supports malware activity but does not establish attribution to SideWinder or another actor.

Key points

An email link led to a Google Sites page impersonating a GlobalProtect download portal; the unsigned MSI installed a standalone executable with deceptive Palo Alto-themed metadata.
The executable checked public-IP geolocation and continued when the result indicated Myanmar, then used a Cloudflare Worker configuration gate and Google service-account OAuth.
One session read and updated Google Sheets cells and polled an empty command cell. A separate session retrieved tasking, launched a Windows shell child, collected 628 bytes of output, and attempted to submit results.
The recovered command requested NGXPckg.exe from cctvcam[.]serveblog[.]net; researchers found the follow-on file in the analysis VM and confirmed its identity.
NGXPckg.exe used a five-minute delay, a Myanmar location check, and GitHub-based configuration and tasking. The investigation reports active runtime paths but does not verify every embedded fallback or remote repository mutation.
The analysis provides sample hashes, infrastructure pivots, persistence details, and YARA hunting rules, while cautioning that shared cloud services should not be blocked globally.
SideWinder is described as a lead for further investigation, not a confirmed attribution; the evidence does not establish the operator or a link to other named malware families.

Article Details

Attack Vectors: An incident-reported email link led to a Google Sites page impersonating a GlobalProtect download portal and offering an unsigned MSI.
The MSI launched its embedded executable through a custom action and configured RunOnce entries; separate code and host artifacts identified a scheduled task.
The first-stage executable continued only after a Myanmar geolocation match, received Google service-account configuration through a Cloudflare Worker, and used spreadsheet cells for identifiers, metadata, tasking, and results.
A later session retrieved encrypted spreadsheet tasking and launched a hidden command shell running curl to download the follow-on executable.
The follow-on payload implemented delayed execution, another Myanmar gate, raw GitHub configuration discovery, and GitHub Contents API command and result exchange.
Defensive Notes: Validate installer signatures, actual publishers, and approved distribution routes rather than trusting product branding or familiar hosting platforms.
Correlate executable hashes, the deceptive installation directory, GlobalProtectVPN RunOnce entries, and the GlobalProtectVPNUpdate scheduled task.
Hunt for SheetsBot/1.0 geolocation requests followed by the exact Worker hostname and Google OAuth or Sheets traffic from the same unsigned executable.
Investigate GlobalProtect.exe spawning cmd.exe /c curl and creation of NGXPckg.exe under C:\ProgramData\USOShared.
Correlate the follow-on executable with its approximately five-minute delay, specific GitHub resources, authenticated PUT followed by same-path GET, and a 16-byte write to %LOCALAPPDATA%\TM87945.
Do not globally block shared Google, Cloudflare, GitHub, or geolocation services, or common Windows DLL names, based on their appearance in this chain.
Preserve volatile evidence securely during incident response. Memory captures can contain private keys, access tokens, personal data, and decrypted content and should not be uploaded to public services.
Treat successful request API returns as distinct from verified remote changes. The traced spreadsheet result write and GitHub PUT did not independently establish remote persistence, and the final GitHub response artifact had unreliable lineage.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`sheets-config-gate[.]hewlett-pack1[.]workers[.]dev`	Malware configuration-gate hostname resolved in retained packet captures; other numbered family members were observed only in process memory.
IPV4	`5[.]230[.]254[.]220`	Alternate C2 endpoint recovered from the follow-on payload's encrypted configuration; runtime use was not observed.
SHA256	`2fd4df25928fa2239d40696c67e638ddb1e10a070a3d9726864a498f68d8559a`	Unsigned NGXPckg.exe follow-on payload copied from the VM deployment and independently reacquired from the recovered delivery URL.
SHA256	`33d696728101c9caf6ebb215ba176bbb94e5cc16218b574029b622fd6e3bee8c`	Unsigned embedded GlobalProtect.exe implementing Myanmar-gated configuration retrieval and Google Sheets command exchange.
SHA256	`a124caa58d956c7430ecb8772a3794266235917670c5b56564342bd1456897e7`	Unsigned deceptive GlobalProtect.msi installer containing the first-stage backdoor.
URL	`hxxps[:]//api[.]github[.]com/repos/faviconicons2/images/contents/License`	Specific GitHub command-channel resource that returned the Readme9823 repository-selection marker to NGXPckg.exe.
URL	`hxxps[:]//api[.]github[.]com/repos/faviconicons2/images/contents/ljrxpCM6T630uiZt/QWRtaW4%20.txt`	Specific per-run GitHub resource used for an authenticated malware PUT and subsequent same-path GET; remote mutation was not verified.
URL	`hxxps[:]//cctvcam[.]serveblog[.]net/weblogin/ngxpkg`	NGXPckg.exe delivery URL recovered from encrypted spreadsheet tasking and independently used by researchers to reacquire the payload.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/thetcoregorup1/collection/refs/heads/main/infosource45`	Specific GitHub-hosted bootstrap configuration resource from which the follow-on payload received 65 bytes.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/thetcoregorup1/collection/refs/heads/main/Readme12`	Specific GitHub-hosted malware discovery resource that returned the Test1234 marker during the follow-on payload trace.