Explore the cyber espionage campaign REF7707, revealing novel malware and operational oversights by attackers in South America and Southeast Asia.

NANOREMOTE, a new Windows backdoor, leverages the Google Drive API for covert C2 and data exfiltration using OAuth 2.0 tokens. The malware shares a hard-coded AES key with the FINALDRAFT family, linking it to seasoned espionage actors.

A new multifunctional Windows trojan dubbed NANOREMOTE leverages a cloud-based file storage service as a covert command-and-control hub,