APT Attacks Target Indian Government with SHEETCREEP, FIREPOWER, and MAILCREEP
- Securityish
- Threats & Incidents
Quick Summary
In September 2025, Zscaler ThreatLabz identified three backdoors—SHEETCREEP, FIREPOWER, and MAILCREEP—used in the Sheet Attack campaign targeting Indian government entities. These backdoors exploit Google Sheets and other cloud services for command-and-control operations, allowing threat actors to blend malicious traffic with legitimate use. The campaign, observed between November 2025 and January 2026, indicates a shift in tactics, including the use of generative AI in malware development, which poses significant cybersecurity risks for affected organizations.
The Securityish Brief
The Sheet Attack campaign, uncovered by Zscaler ThreatLabz, employs three sophisticated backdoors: SHEETCREEP, FIREPOWER, and MAILCREEP. Discovered in September 2025, these tools are primarily targeting Indian government entities. The campaign utilizes Google Sheets as a command-and-control (C2) channel, a tactic that is particularly unusual and effective in evading security measures.
Between November 2025 and January 2026, ThreatLabz observed the deployment of these backdoors, which include SHEETCREEP, a lightweight C# backdoor that communicates via Google Sheets, and FIREPOWER, a PowerShell-based backdoor that uses Firebase Realtime Database for C2. MAILCREEP, developed in Golang, manipulates emails using Microsoft’s Graph API.
The initial infection vector often involved phishing PDFs that led users to download malicious ZIP archives containing the SHEETCREEP backdoor. More recent campaigns have transitioned to using malicious LNK files to deploy FIREPOWER. This evolution in tactics highlights the adaptability of threat actors.
ThreatLabz has identified high-confidence indicators suggesting that generative AI tools were utilized in the development of these backdoors. This trend reflects a growing sophistication in malware development, as seen with the use of emojis and verbose comments in the code.
Threat attribution suggests that these campaigns may originate from a new subgroup linked to Pakistan, with similarities to the known APT36 group. The campaigns exhibit a blend of traditional APT36 tactics and new techniques, indicating an evolution in threat actor capabilities.
Implications for Cybersecurity
The use of legitimate cloud services for C2 operations poses significant risks for organizations, particularly those in sensitive sectors like government. The blending of malicious traffic with legitimate services complicates detection and response efforts.
Organizations should be vigilant about phishing attempts that may use similar tactics, such as deceptive PDF documents. Monitoring for unusual activity in cloud services and email accounts is crucial to mitigate potential threats.
- SHEETCREEP: A lightweight backdoor written in C# that uses Google Sheets for C2 communication.
- FIREPOWER: A PowerShell-based backdoor that exploits Google’s Firebase Realtime Database for its C2 channel.
- MAILCREEP: A Golang-based backdoor leveraging the Microsoft Graph API for its C2 communications.
Key Takeaways
- Educate employees about phishing tactics, particularly those involving deceptive PDF documents.
- Regularly monitor cloud service accounts for unusual activity or unauthorized access.
- Implement robust email filtering to detect and block potential phishing attempts.
- Conduct regular cybersecurity training to keep staff informed about evolving threats.
- Review and update incident response plans to address potential attacks leveraging cloud services.
Key Terms & Concepts
- SHEETCREEP: In this article, SHEETCREEP refers to a lightweight backdoor that uses Google Sheets for command-and-control communication.
- FIREPOWER: FIREPOWER is a PowerShell-based backdoor that exploits Google’s Firebase Realtime Database for its command-and-control channel.
- MAILCREEP: MAILCREEP is a Golang-based backdoor that manipulates emails using Microsoft’s Graph API.
- generative AI: Generative AI refers to artificial intelligence systems that can create content, including code, which may be used in malware development.
Read the original article here: https://securityboulevard.com/2026/01/apt-attacks-target-indian-government-using-sheetcreep-firepower-and-mailcreep-part-2/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
