NANOREMOTE Malware Abuses Google Drive for Covert Command-and-Control

Security researchers at Elastic¹ have uncovered a newly identified Windows backdoor, dubbed NANOREMOTE, that repurposes the Google Drive API as its command-and-control (C2) channel. Rather than communicating with attacker-owned servers, the malware abuses Google’s trusted cloud infrastructure to exchange commands, upload stolen data, and retrieve additional payloads. This approach allows malicious traffic to blend with legitimate enterprise cloud activity, making detection significantly more challenging for traditional network-based security controls.

The discovery also provides another example of a growing trend in advanced cyber-espionage campaigns: attackers increasingly rely on legitimate cloud platforms instead of dedicated command-and-control infrastructure. By hiding inside services that organizations already trust, malware operators reduce the likelihood that their communications will be blocked or even investigated.

Key Findings

Elastic’s analysis shows that NANOREMOTE is far more than a simple remote shell. It implements a sophisticated task management framework that allows operators to schedule, monitor, pause, resume, retry, and cancel long-running operations, particularly large file transfers. Each operation is assigned a unique task identifier, enabling attackers to manage multiple activities simultaneously without interrupting ongoing communications.

One of the malware’s most notable features is its extensive use of the Google Drive API. Instead of transmitting stolen files directly to an attacker-controlled server, NANOREMOTE stores them inside Google Drive folders under attacker control. Commands are delivered through the same mechanism, effectively turning Google Drive into a hidden message queue between the victim and the operator.

Code analysis also revealed strong similarities with another sophisticated backdoor known as FINALDRAFT (also called Squidoor), which performs a nearly identical role but communicates through the Microsoft Graph API rather than Google Drive. Both malware families share encryption routines, architectural design, internal functions, and task management logic, suggesting they originated from the same development team. (Elastic)

Researchers attribute both malware families to the threat cluster REF7707, also tracked as CL-STA-0049, Earth Alux, or Jewelbug, a suspected China-aligned espionage group active since at least March 2023. Known victims include government agencies, defense contractors, telecommunications providers, aviation organizations, educational institutions, and IT companies throughout Southeast Asia and South America. Researchers also identified activity targeting a Russian IT services provider during 2025, indicating the group’s continued operational expansion.

Infection Chain Begins with a Loader

Although the initial access method remains unknown, Elastic reconstructed much of the malware deployment process.

The attack begins with a loader called WMLOADER, which masquerades as the legitimate Bitdefender component BDReinit.exe. This impersonation helps the malware appear trustworthy while bypassing casual inspection by users and administrators.

Once executed, WMLOADER decrypts an embedded shellcode payload using a hard-coded AES key before injecting and launching the final NANOREMOTE implant directly in memory. This staged architecture separates the loader from the backdoor itself, making static analysis more difficult while allowing operators to replace the final payload without modifying the initial loader.

Technical Capabilities

Written in C++, NANOREMOTE provides operators with a comprehensive set of remote administration capabilities suitable for long-term espionage operations.

After execution, the malware collects detailed host information, including operating system version, hostname, running processes, user context, and system configuration. This reconnaissance allows operators to determine whether the compromised system is valuable enough for continued exploitation.

The implant can execute arbitrary commands and launch additional binaries received from the command-and-control infrastructure. It also supports bidirectional file transfers, allowing attackers to both exfiltrate sensitive documents and deploy additional malware components, updated tools, or specialized plugins as needed.

Unlike many modern backdoors that communicate directly with internet-facing infrastructure, NANOREMOTE performs its cloud communications through the Google Drive API while maintaining a secondary HTTP communication mechanism using POST requests to the /api/client endpoint. Traffic identifies itself using the NanoRemote/1.0 User-Agent string. Before transmission, collected data is compressed with Zlib and encrypted using AES-CBC with a static 16-byte encryption key, adding another layer of protection against network inspection.

Elastic also observed that the malware maintains careful control over data transfers. Instead of simply uploading files, operators can monitor transfer progress, restart interrupted uploads, and manage multiple simultaneous tasks through the malware’s internal scheduling system. These features are more commonly associated with commercial remote administration software than traditional malware, highlighting the increasing sophistication of modern espionage tools.

Infrastructure Reuse Exposes Threat Actor

One of the most significant findings in Elastic’s investigation came from a seemingly ordinary log file uploaded to VirusTotal from the Philippines during October 2025.

Researchers discovered that wmsetup.log could be decrypted using the exact same AES key employed by WMLOADER. Rather than containing diagnostic information, the decrypted contents revealed a FINALDRAFT implant.

This accidental exposure provided a direct forensic link between NANOREMOTE and FINALDRAFT, confirming that both malware families share common infrastructure and development practices. It also exposed an operational security mistake by the threat actor: reusing the same static encryption key across separate malware families significantly simplified attribution and reverse engineering efforts.

Trusted Cloud Services Continue to Challenge Defenders

NANOREMOTE illustrates a broader evolution in advanced persistent threat operations. Instead of building custom command-and-control infrastructure that defenders can block or sinkhole, attackers increasingly exploit legitimate cloud platforms such as Google Drive, Microsoft Graph, Dropbox, GitHub, OneDrive, and other trusted SaaS services. Because these platforms are routinely accessed by enterprise users, malicious traffic can easily blend into normal business activity.

This shift also reduces the effectiveness of network-based detection alone. Organizations must increasingly rely on behavioral analysis, endpoint telemetry, identity monitoring, and cloud activity analytics to identify suspicious use of otherwise legitimate services.

Why Initial File Prevention Still Matters

While Elastic has not yet determined how victims are initially compromised, nearly every sophisticated espionage campaign ultimately requires an initial execution point. Whether delivered through phishing attachments, compressed archives, virtual disk images, trojanized software installers, malicious documents, or downloader scripts, the attacker must first convince a user or system to execute an initial payload.

This is precisely where preventive Content Analysis, Disarm, and Reconstruction (CADR) technologies provide value. By structurally analyzing incoming files, removing embedded active content, scripts, malicious executables, and hidden payloads before they reach endpoints, CADR solutions can eliminate the initial delivery mechanism regardless of whether the final malware communicates through Google Drive, Microsoft Graph, or any other cloud platform. Preventing the loader from executing means WMLOADER never decrypts NANOREMOTE, preventing the entire compromise chain before persistent command-and-control can be established.