NANOREMOTE Malware Leverages  Google Drive API for Command-and-Control (C2) to Attack Windows Systems

A sophisticated new Windows backdoor named NANOREMOTE emerged in October 2025, presenting a significant threat to enterprise environments by leveraging legitimate cloud infrastructure for malicious purposes.

This fully-featured malware utilizes the Google Drive API as its primary Command-and-Control (C2) channel, allowing threat actors to blend their malicious traffic seamlessly with normal network activity.

By abusing trusted services, NANOREMOTE bypasses traditional network-based detection mechanisms, enabling stealthy data exfiltration and payload staging.

The malware is written in C and shares significant code similarities with the previously identified FINALDRAFT implant, suggesting a shared development lineage or a common author.

The infection chain typically begins with a loader component known as WMLOADER, which often masquerades as a legitimate security executable such as Bitdefender’s BDReinit.exe to evade suspicion.

Upon execution, WMLOADER decrypts a payload file named wmsetup.log utilizing an AES-CBC algorithm, subsequently launching the NANOREMOTE backdoor directly into memory.

This method minimizes the malware’s footprint on the disk, complicating forensic analysis and preventing simple file-based detection signatures from working effectively.

Elastic Security Labs security analysts identified that beyond its primary C2 mechanism, NANOREMOTE incorporates advanced evasion techniques such as API hooking via the Microsoft Detours library to intercept process termination calls.

This ensures the malware maintains persistence and resilience against crashes.

The implant also features a custom PE loader derived from the libPeConv library, enabling it to load and execute additional executable modules directly from disk or memory without relying on the standard Windows loader. These features highlight the sophistication of the threat.

Google Drive C2 Communication Architecture

The most distinct feature of NANOREMOTE is its reliance on the Google Drive API for bidirectional communication.

The malware authenticates using hard-coded OAuth 2.0 tokens, including Client IDs and Refresh Tokens, stored in a pipe-separated configuration string.

Communications are secured via HTTPS and further obfuscated using Zlib compression and AES encryption.

The malware operates using a polling mechanism where it checks for queued tasks, such as file uploads or downloads, assigned by the operator.

The download from Google Drive illustrates how these requests appear on the network, mimicking legitimate API calls. To facilitate these operations, NANOREMOTE utilizes specific command handlers.

For instance, Handler 16 and Handler 17 are responsible for queuing download and upload tasks, respectively. The malware parses the JSON responses from the Google Drive API to execute instructions.

The Control flow graph shows command handlers; the malware dispatches tasks based on a switch statement covering 22 distinct commands.

This structure allows the attackers to precisely control the victim machine, managing files and executing payloads while hiding within encrypted traffic.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.