Fake GlobalProtect MSI Targets Myanmar Using Cloudflare and Google Sheets as C2

Immediate Actions

Key Takeaways

• AES-256-CBC config decryption uses SHA-256 of string 'AmountOfFreeDiskSpace' as key
• Nine numbered Worker hosts hewlett-pack1 through 9; only host 1 DNS-observed
• Device identifier marker '-tk-' used for persistent victim tracking across sessions
• Sheet1 columns A-D map to device ID, victim IP, command queue, and result output
• Build and MSI package timestamps differ by only 18 seconds (2026-08-19 06:08:59 UTC)

Attack Chain

1. Initial Access: Phishing email links to Google Sites page offering fake GlobalProtect download
2. Execution: Unsigned MSI installs GlobalProtect.exe via /Install custom action
3. Persistence: RunOnce registry keys and scheduled task GlobalProtectVPNUpdate created
4. Reconnaissance: Queries ip-api.com for geolocation; activates only if country is Myanmar
5. C2 Config: Contacts Cloudflare Worker gate at /config0; receives Google service-account credentials
6. C2 Channel: Authenticates to Google OAuth; polls Google Sheets cells for commands and writes results

Affected Systems

• Windows x64 systems
• Organizations operating in Myanmar
• Users expecting Palo Alto GlobalProtect VPN

Detection Availability

• Published: YARA
• Platforms: Malware INFO article

YARA hunting rule published in article combining gate path, header, Sheets ranges, and campaign markers.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Sysmon EID 1 process creation
• Sysmon EID 11 file creation
• Sysmon EID 12/13 registry modification
• DNS query logs
• Proxy logs with user-agent strings
• Windows Task Scheduler EID 4698

Key Behavioral Indicators

• Unsigned GlobalProtect.exe under C:\Program Files\PaloAlto\GlobalProtect VPN
• SheetsBot/1.0 user agent requesting ip-api.com/json
• DLL files written beside GlobalProtect.exe in application directory
• GlobalProtect.exe /Install invoked from MSI custom action
• Process contacting workers.dev then Google OAuth/Sheets APIs
• GlobalProtectVPN RunOnce values or GlobalProtectVPNUpdate scheduled task

Control Gaps

• TLS inspection cannot reveal Google Sheets C2 traffic content
• Legitimate cloud services may be allowlisted in proxy rules
• Geolocation guardrail prevents sandbox detonation outside Myanmar
• Unsigned MSI may execute if filename-based trust is configured

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Block unsigned MSI packages from executing via AppLocker or WDAC
• Alert on SheetsBot/1.0 user agent in proxy and web gateway logs
• Monitor Google OAuth token requests from non-browser processes
• Restrict outbound *.workers.dev traffic where not business-required

User Protection

• Validate VPN client downloads against vendor official distribution channel
• Verify Authenticode signatures before installing any VPN software
• Report unsolicited GlobalProtect download links to security team

Security Awareness

• Train staff to verify software sources before installation
• Warn about fake VPN installer phishing targeting Myanmar organizations

MITRE ATT&CK Mapping

Plain-Language Summary

Attackers sent fake VPN software to organizations in Myanmar. The software pretended to be Palo Alto Networks GlobalProtect but was actually a backdoor that checked the victim's location and only activated in Myanmar. It used Google Sheets, a normal spreadsheet service, as a hidden channel to receive commands. Organizations should verify all software downloads come from official vendor sources and check for the specific file hashes and indicators listed in this report.

Additional IOCs

• Urls:
  • /config0 - Worker configuration endpoint path for C2 gate
• File Hashes:
  • 811af66dd7e323a74db80648610bbeb956093ae7bd91c5b950ed6aca13d8026 (SHA256) - bcrypt.dll copy placed beside executable in install dir
  • c692af3f8741669cd1b517c461e80bce19ad6e8608c81066cde9786f17be0099 (SHA256) - CRYPT32.dll copy placed beside executable in install dir
  • 948589c349b0205ff73c7049b0d2e5c4faffb64271c64ee0033e384f61cf51d6 (SHA256) - WININET.dll copy placed beside executable; no embedded signature
  • 8a680fcc160c352ed2d9b96654e50bf0f5f504141828aa50b75b970f46f3f170 (SHA256) - paloalto.png branding resource embedded in MSI
• File Paths:
  • C:\Program Files\PaloAlto\GlobalProtect VPN\GlobalProtect.exe - Deceptive installation path for fake GlobalProtect executable
• Command Lines:
  • Purpose: Install the malicious MSI package and trigger executable | Tools: msiexec, GlobalProtect.exe | Stage: Execution | GlobalProtect.exe /Install
• Other:
  • {49CB5141-CEC5-4324-BB91-E2D843CD4DE1} - MSI ProductCode for clustering and package identification
  • {BF73E425-31E9-4F43-AFA3-B928117CAEA2} - MSI UpgradeCode for clustering and package identification
  • 101714939433347726433 - Google client ID associated with recovered service account
  • elliptical-tree-505904-p7 - Google Cloud project ID used by malware for Sheets C2
  • -tk- - Device identifier marker embedded in generated persistent ID
  • X-Bot-Secret - Gate authentication header name sent to Cloudflare Worker
  • SheetsBot/1.0 - Campaign user agent used for ip-api and Worker requests
  • GlobalProtectVPNUpdate - Scheduled task name for persistence via Task Scheduler
  • sheets-config-gate.hewlett-pack{1..9}.workers.dev - Numbered Worker family; hosts 2-9 memory-observed only