A sophisticated attack campaign that chains Microsoft Teams vishing, Quick Assist remote access, and Google Drive command-and-control infrastructure to deploy a Java-based remote access trojan (RAT) dubbed Nimbus RAT.
The campaign, first identified in April 2026, has targeted at least 172 organizations over 12 months, with activity surging nearly 8x above baseline in February 2026 alone.
The intrusion begins with inbox bombing in the documented case targeting a legal sector firm, 282 emails arrived within 90 minutes on April 6, 2026, peaking at 26 per minute from 116 unique sender domains, Esentire said.
Abuse Microsoft Teams and Google Drive to Deploy Malware
Approximately 45 minutes after the peak of the flood, a threat actor using a Microsoft Teams external account impersonating the IT helpdesk contacted the victim, offering to resolve the inbox chaos.
After convincing the victim to launch Quick Assist, the attacker pasted a Pastebin URL (pastebin[.]com/G6jA0PLU) into the chat, containing a four-line instruction checklist, a payload download URL, a persistence path, an extraction directory, and an archive name.
The victim downloaded InboxCorePro.zip (SHA-256: 9E5B1E10AD6904D3F5B48D38470CD57263974640A27D13CF793EF026D3D6B886) from a compromised Microsoft 365 SharePoint tenant.
From initial Teams contact to RAT execution, the entire sequence took less than 20 minutes, Esentire said.
The malware tracked internally as BackupBOX with campaign UUID 1hc1his4gmto0q1 is a self-contained Java archive (InboxCorePro.jar, SHA-256: 91E523A46F3BB860AC2E5800B7E1EC89D75A2408410B9CD25EEBC17C8D7A92BC) that bundles its own OpenJDK 25.0.1 runtime, ensuring portability across any Windows endpoint regardless of Java installation.
Its most evasive feature is its C2 design. Nimbus RAT uses Google Drive (via Service Account and OAuth2 channels) to poll for operator commands (file: entry_{campaignUUID}) and exfiltrate responses (exit_{campaignUUID}).
All traffic transits legitimate Google API endpoints, making network-layer blocking impractical in Google Workspace environments. All C2 communication is RSA-4096 encrypted.
The RAT supports a broad operator capability set including arbitrary shell execution, full filesystem access, registry manipulation, screenshot capture, in-memory Java plugin loading (jc/jcb commands), and two credential theft methods a fake Windows Security dialog built in Java Swing and a native CredUIPromptForCredentialsW invocation via JNA.
Both mechanisms capture two password submissions by triggering a fake “incorrect password” error on first entry, according to esentire, TRU’s analysis of 1,540 detection events identified clear infrastructure fingerprints:
- 65% of malicious Teams messages originated from
*.onmicrosoft.comtrial tenants - 80% of events came from hosting/datacenter ASNs, not corporate ISPs
- 49% of sender accounts impersonated the IT helpdesk using usernames like
helpdesk,itsupport, andcloudsupport - 37% of custom domains were registered within 7 days of use, primarily through PDR Ltd
TRU links the campaign to BlackSuit affiliate activity and Black Basta-derived crews following Black Basta’s internal conflict in early 2025, with overlapping TTPs also aligned to Storm-1811.
Mitigation
Defenders should turn off external Teams messaging from trial tenants (blocking 65% of observed attack volume), alert on mailbox flooding exceeding 20 emails per minute, and create EDR rules for javaw.exe executing JARs from C:\ProgramData\.
Network teams should enable process-level attribution on googleapis.com traffic and monitor Google Workspace audit logs for OAuth grants to an application named BackupBOX with Drive scopes as a high-confidence IOC.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 has uncovered a sophisticated attack campaign that chains Microsoft Teams vishing, Quick Assist remote access, and Google Drive command-and-control infrastructure to deploy a Java-based remote access trojan (RAT) dubbed Nimbus RAT.){kind=link}