12 track album

A malware campaign in India called Operation ShadowRecruit uses fake government job postings to spread the SheetAgent RAT, which uses Google Sheets for C2.

Operation ShadowRecruit targets Indian job seekers with SheetAgent RAT, abusing ControlR and Google Sheets for C2. Seqrite links it to APT36. #OperationShadowRecruit #APT36 #SheetAgent #Malware #InfoSec At a Glance Actor or group Suspected APT36 (medium confidence) Activity type Multi-stage malware campaign with a recruitment lure Targets Indian government job seekers; public sector, education, technology Scale

Introduction: When Career Dreams Become a Cybersecurity Nightmare Job opportunities are often moments of hope, especially when they involve prestigious government positions. Unfortunately, cybercriminals are increasingly exploiting that trust by turning recruitment processes into attack vectors. Instead of sending traditional phishing emails asking for passwords or financial information, modern threat actors are creating realistic-looking employment documents designed to infect computers silently.

Seqrite tracked Operation ShadowRecruit, a multi-stage campaign targeting Indian government job seekers with a fake Cabinet Secretariat recruitment notice and a ZIP file containing a malicious LNK, PowerShell script, and .NET loader. The attack abuses ControlR and Google Sheets/Google Drive for remote access and backup command-and-control, and is assessed with moderate confidence to be linked to APT36. #APT36 #ControlR #GoogleSheets #SheetAgentRAT

Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Initial Findings Looking into the Decoy Document Technical