Operation ShadowRecruit Uses Fake Government Job Ads to Plant SheetAgent RAT on Indian Systems
Do Son 
Operation ShadowRecruit targets Indian job seekers with SheetAgent RAT, abusing ControlR and Google Sheets for C2. Seqrite links it to APT36.
#OperationShadowRecruit #APT36 #SheetAgent #Malware #InfoSec
https://securityonline.info/operation-shadowrecruit
At a Glance
| Actor or group | Suspected APT36 (medium confidence) |
| Activity type | Multi-stage malware campaign with a recruitment lure |
| Targets | Indian government job seekers; public sector, education, technology |
| Scale | Victim count not disclosed |
| Law enforcement status | No public action reported |
| Source | Seqrite APT Research Team |
TL;DR
Researchers have uncovered Operation ShadowRecruit, a campaign that poses as an Indian government hiring notice. Attackers deliver a ZIP archive that installs the legitimate ControlR remote management tool alongside a custom RAT called SheetAgent. The malware receives commands through an attacker-controlled Google Sheets document.
What Happened
The Seqrite APT Research Team spotted an archive named “Approved Documents 2026.pdf.zip” during threat hunting. It holds three files, but only a shortcut stays visible. The other two carry the Hidden attribute, so Windows Explorer conceals them by default.
That shortcut wears a Microsoft Edge icon and quietly runs a PowerShell script. The script pulls the ControlR agent installer and enrolls the machine into the attacker’s own ControlR tenant. Meanwhile, a .NET dropper extracts two more files into a folder named WinSyncDefender, which mimics a real Windows component.
Victims see a decoy PDF while this runs. The decoy is a scanned Employment News advertisement for Senior Field Officer roles at India’s Cabinet Secretariat. It looks convincing because it is a genuine notice, copied and hosted on attacker infrastructure.
SheetAgent and the Google Sheets C2
The final payload runs as WindowsDefenderSyncService.exe. Seqrite named it SheetAgent. The RAT carries hardcoded Google service account credentials and authenticates to a spreadsheet that doubles as its backup command channel.
Each column holds a job. One stores the computer name, another the attacker’s commands, another the output, and another the public IP. The malware claims a row per victim, then polls it for instructions. As a result, the traffic blends into ordinary Google API activity.
Persistence relies on a scheduled task called WindowsDefenderSyncService that fires at login and every three minutes. If that fails, the malware drops a startup shortcut instead. It also runs 14 separate virtual machine checks and self-destructs through a cleanup script when it detects analysis tools.
Who Is Behind It
Seqrite writes that it attributes “with medium confidence that this campaign is likely associated with APT36.” The team points to the multi-stage chain, the C2 design, and persistence tricks matching earlier APT36 operations. APT36 is a suspected Pakistan-linked group long tied to attacks on Indian government targets.
That confidence level matters. Medium confidence means the evidence fits, but it does not prove the link. Notably, Zscaler ThreatLabz has documented a separate campaign using Google Sheets for C2 and similar .NET malware, which supports the tradecraft overlap without settling attribution.
Investigators also found web panels on the same server, branded SecureMonitor and PrivateRat. The PrivateRat login page named its developer as HeartMelt. No authority has charged anyone, and the operators remain unidentified.
Impact and Scale
Neither Seqrite nor any agency has published a victim count for Operation ShadowRecruit. The affected sectors span government, academia, and technology, with India as the sole geographic focus. Successful enrollment in the attacker’s ControlR instance grants remote control, command execution, file transfer, and activity monitoring.
The Google Drive folders tied to the campaign sat empty during the investigation, so stolen data volume stays unknown. Job seekers make appealing targets, since many later enter sensitive government roles.
What Comes Next and How to Stay Protected
Treat unsolicited recruitment archives with suspicion, especially ZIP files claiming to hold PDFs. Enable file extensions and hidden file visibility in Windows Explorer, which exposes the trick used here. Defenders should hunt for scheduled tasks and folders imitating Defender or sync services.
Monitoring for unexpected RMM installs also helps, since ControlR is legitimate software and antivirus rarely blocks it. Blocking unapproved RMM tools by policy closes that path.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
