NANOREMOTE Malware Leverages Google Drive API for Command-and-Control (C2) to Attack Windows Systems
## Cybersecurity: NANOREMOTE Malware Analysis
Cybersecurity: NANOREMOTE Malware Analysis
In October 2025, a sophisticated Windows backdoor named NANOREMOTE was identified, posing a significant threat to enterprise environments. This malware exploits legitimate cloud infrastructure for malicious purposes.
NANOREMOTE uses the Google Drive API as its primary Command-and-Control (C2) channel. This allows threat actors to seamlessly blend malicious traffic with normal network activity. The malware is written in C and shows code similarities with the previously known FINALDRAFT implant.
The infection chain typically initiates with a loader component, WMLOADER, which often disguises itself as a legitimate security executable, such as Bitdefender’s BDReinit.exe. Upon execution, WMLOADER decrypts a payload file named wmsetup.log using an AES-CBC algorithm, launching the NANOREMOTE backdoor directly into memory. This minimizes its footprint on the disk and complicates forensic analysis.
NANOREMOTE incorporates advanced evasion techniques, such as API hooking via the Microsoft Detours library, to intercept process termination calls, ensuring persistence and resilience against crashes. It also features a custom PE loader derived from the libPeConv library, enabling it to load and execute modules directly from disk or memory.
In October 2025, a sophisticated Windows backdoor named NANOREMOTE was identified, posing a significant threat to enterprise environments.
Google Drive C2 Communication Architecture
The malware's reliance on the Google Drive API for bidirectional communication is its most distinct feature. It authenticates using hard-coded OAuth 2.0 tokens, including Client IDs and Refresh Tokens, stored in a pipe-separated configuration string. Communications are secured via HTTPS and further obfuscated using Zlib compression and AES encryption.
NANOREMOTE operates using a polling mechanism to check for queued tasks, such as file uploads or downloads, assigned by the operator. The requests mimic legitimate API calls, facilitating operations through specific command handlers. For instance, Handler 16 and Handler 17 manage download and upload tasks, respectively.
The control flow graph shows command handlers, allowing attackers to precisely control the victim machine while hiding within encrypted traffic.
Based on reporting by Cyber Security News.