Do Son NANOREMOTE, a new Windows backdoor, leverages the Google Drive API for covert C2 and data exfiltration using OAuth 2.0 tokens. The malware shares a hard-coded AES key with the FINALDRAFT family, linking it to seasoned espionage actors.
FINALDRAFT
Explore the cyber espionage campaign REF7707, revealing novel malware and operational oversights by attackers in South America and Southeast Asia.