A sophisticated backdoor targeting Myanmar-region users has emerged masquerading as Palo Alto's legitimate GlobalProtect VPN software. This malware employs an unusual command-and-control architecture that abuses Google Sheets as its communications channel, making detection significantly more difficult since the traffic appears as routine Google API requests. The threat demonstrates advanced geographic targeting, refusing to activate unless the victim's public IP address resolves to Myanmar—a technique that helps it evade sandbox analysis and avoid unwanted attention in other regions.
First documented in September 2026, this malware represents a concerning evolution in attacker tradecraft. By leveraging trusted cloud services like Google Sheets and Cloudflare Workers for infrastructure, the operators bypass many traditional network security controls. The unsigned 64-bit executable arrives packaged in a fraudulent MSI installer, complete with branding designed to convince users they're installing enterprise security software.
Threat Profile
| Attribute | Value |
|---|---|
| Threat Name | Unidentified 126 (GoogleSheets C2) |
| Platform | Windows (x64 only) |
| File Type | Windows PE32+ executable (native 64-bit) |
| Distribution Package | Fraudulent MSI installer (unsigned) |
| First Observed | September 2026 |
| Geographic Target | Myanmar (activation guardrail enforced) |
| C2 Infrastructure | Cloudflare Workers (config gate) + Google Sheets API |
| Authentication Method | Google service account credentials (retrieved dynamically) |
| Application Type | Native Windows GUI application |
| Signing Status | Unsigned (no valid code signature) |
| Persistence Mechanism | Typical for backdoor class (registry run keys observed in sandbox) |
| Detection Aliases | Unidentified 126, GoogleSheets C2 backdoor |
How It Spreads
The primary distribution vector for this threat involves social engineering campaigns that impersonate legitimate enterprise VPN software. Victims receive what appears to be a GlobalProtect VPN installer—software widely deployed in corporate environments for secure remote access. The fake installer arrives as an MSI package, lending an air of legitimacy since Microsoft Installer files are the standard deployment format for enterprise Windows applications. The file itself lacks any valid code signature, but many users don't check certificate details before running installers, especially if they believe they're following IT department instructions.
Evidence suggests these fraudulent installers reach victims through targeted phishing campaigns, watering-hole attacks on Myanmar-specific websites, or supply-chain compromise of regional software distribution channels. The geographic targeting is not merely operational security—the malware actively refuses to execute outside Myanmar, checking the victim's public IP address against a geolocation service before proceeding with installation. This technique serves dual purposes: it focuses the campaign on intended victims while simultaneously frustrating researchers who attempt analysis from infrastructure in other countries.
Common infection pathways include:
- Phishing emails with VPN installation instructions: Messages impersonating IT departments or VPN vendors, often referencing remote work policies or security updates
- Compromised websites serving trojanized installers: Legitimate-looking download pages that host the malicious MSI alongside or instead of genuine software
- File-sharing services and torrent sites: Cracked or pirated software bundles that include the backdoor as a secondary payload
- Drive-by downloads from compromised regional websites: Automatic download initiation when visiting infected sites popular in the target geography
- USB drives and removable media: Physical distribution in environments where internet access is limited or monitored
What It Does On Your Machine
Once executed, the malware implements a multi-stage activation process that demonstrates careful operational planning. The initial executable performs a geolocation check by contacting a public IP lookup service, verifying that the victim's internet connection originates from Myanmar before proceeding further. If this check fails, the malware terminates without installing, leaving minimal forensic traces. For victims in the target region, the backdoor continues to a configuration-retrieval phase where it contacts a Cloudflare Workers endpoint—a serverless computing platform that provides the attackers with resilient, difficult-to-block infrastructure.
The Cloudflare Worker acts as a configuration gate, responding with Google service-account credentials and a Google Sheets spreadsheet identifier. This staged design means the malware binary itself contains no hardcoded credentials or command-and-control addresses, making static analysis significantly less valuable. The backdoor then uses the received credentials to authenticate against Google's OAuth endpoint, obtaining an access token that allows it to read from and write to the specified spreadsheet. From the attacker's perspective, this architecture is brilliant: all command-and-control traffic appears as legitimate Google API requests, typically allowed through corporate firewalls and difficult to distinguish from normal Google Workspace usage.
The Google Sheets spreadsheet serves as a bidirectional communication channel. The malware periodically polls specific cells for commands, executes the requested actions, and writes results back to designated cells. This allows operators to issue commands, exfiltrate data, and manage multiple infected systems through a simple spreadsheet interface—no custom server infrastructure required. The backdoor operates as a native Windows GUI application, meaning it has full access to the Windows API and can perform virtually any action a logged-in user could perform, including file system access, registry manipulation, process execution, and network communications.
Manual Removal — Step by Step
Disconnect from the internet immediately
Unplug your Ethernet cable or disable WiFi through the physical hardware switch if available. This malware's Google Sheets C2 channel operates through HTTPS connections that appear legitimate, so software firewalls may not block it. Physical disconnection prevents further command execution or data exfiltration while you work.
Boot into Safe Mode with Networking
Restart your computer and press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking." This loads Windows with minimal drivers and services, preventing most malware from auto-starting while still allowing you to download tools. If F8 doesn't work, access Safe Mode through Settings → Update & Security → Recovery → Advanced startup.
Identify and terminate suspicious processes
Open Task Manager (Ctrl+Shift+Esc) and examine the Processes tab for unfamiliar executables, especially unsigned 64-bit applications. The malware presents as a native Windows GUI application, so look for processes without Microsoft or other recognizable publishers. Right-click suspicious entries, select "Open file location," then note the full path before terminating the process. Do NOT delete files yet—you need to locate all persistence mechanisms first.
Check registry persistence locations
Press Win+R, type "regedit," and navigate to these common persistence keys: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce. Look for entries referencing the executable path you identified in step 3, or any entries that seem unfamiliar or reference temporary directories. Document these entries by taking screenshots before deletion.
Examine scheduled tasks and services
Open Task Scheduler (search in Start menu) and review the Task Scheduler Library for tasks created recently or referencing suspicious executables. Check Services (services.msc) for any unsigned services with random or generic names. Sophisticated backdoors often install as services for reliability. Disable any suspicious scheduled tasks or services, but document their configuration first—you'll need this information to verify complete removal.
Delete malware files and associated components
Navigate to the file locations you identified earlier and delete the main executable plus any associated files in the same directory. The fraudulent MSI installer may still exist in your Downloads folder—remove it. Check C:\ProgramData, C:\Users\[YourName]\AppData\Local, and C:\Users\[YourName]\AppData\Roaming for folders created on the infection date. Empty the Recycle Bin when finished.
Run comprehensive antimalware scans
Update Windows Defender definitions (or your installed antivirus) and run a full system scan. Follow with scans from Malwarebytes and HitmanPro—these secondary tools catch variants that primary antivirus may miss. Because this threat uses Google infrastructure for C2, signature-based detection may be limited. Behavioral analysis tools are more effective for this class of malware.
Review browser security and saved credentials
Since the malware operates through Google services, check your browser's saved passwords and active sessions. Open Chrome/Edge settings, navigate to Privacy and Security, and review site permissions—particularly those granted to Google Sheets or unfamiliar domains. Sign out of all Google accounts and change passwords from a confirmed-clean device. Revoke OAuth tokens through your Google Account security settings.
Monitor for reinfection indicators
Restart normally (not Safe Mode) and monitor Task Manager and outbound connections for 24-48 hours. Use Resource Monitor (resmon.exe) to watch network activity—look for sustained connections to googleapis.com that occur when you're not actively using Google services. The malware polls the spreadsheet periodically, so unusual patterns in Google API traffic indicate incomplete removal.
Consider professional verification and system hardening
Even after following these steps, remnants may persist in locations difficult for manual removal—particularly if the malware achieved SYSTEM-level privileges. Our diagnostic tools can verify clean removal and identify privilege escalation artifacts. We'll also review your security configuration to prevent reinfection, including disabling unsigned code execution through Windows Defender Application Control policies where appropriate.
Prevention
- Never execute unsigned MSI installers or executables: Verify code signatures before running any installer, especially for security software. Right-click the file, select Properties, and check the Digital Signatures tab. Legitimate enterprise software from vendors like Palo Alto Networks will always be signed with a valid certificate from the vendor.
- Implement application whitelisting where practical: Windows 10 Pro and Enterprise editions support Application Control policies that prevent execution of unsigned code. While this requires careful configuration, it's highly effective against threats that rely on unsigned executables like this backdoor.
- Maintain rigorous patch management: Keep Windows, all applications, and security software current. While this specific malware doesn't exploit software vulnerabilities, attackers often bundle backdoors with exploits that target unpatched systems. Automatic updates should be enabled for both Windows and all installed applications.
- Deploy network monitoring for unusual cloud service usage: Enterprise environments should monitor for atypical Google API usage patterns, particularly authentication requests from service accounts that weren't provisionally created by IT. Residential users with advanced routers can enable logging and periodically review connection logs for sustained connections to cloud platforms during periods when those services aren't being actively used.
- Educate about VPN installation procedures: Legitimate IT departments rarely email VPN installers directly. Corporate VPN clients should be installed through official software portals or IT-supervised processes. If you receive unsolicited instructions to install VPN software, verify through a known-good contact method (phone call to IT, not email reply) before proceeding.
- Use DNS filtering to block known-malicious infrastructure: Services like Cloudflare's 1.1.1.1 for Families or Quad9 block access to confirmed-malicious domains. While this specific threat uses legitimate Cloudflare Workers infrastructure, DNS filtering catches many related threats and is an effective general defense.
- Restrict execution from temporary directories: Configure Windows to prevent executable launch from %TEMP%, %APPDATA%, and user-profile Downloads folders. This can be accomplished through Group Policy (Software Restriction Policies) and blocks a common malware execution pattern without impacting normal software installation.
- Implement multi-factor authentication on all accounts: While MFA doesn't prevent initial infection, it limits the damage if the malware harvests credentials. The backdoor's access to Google services is particularly concerning—ensure all Google accounts use hardware security keys or authenticator apps rather than SMS-based 2FA.
Bring It In
This particular threat demonstrates why DIY malware removal carries substantial risk. The Google Sheets command-and-control architecture means infected systems may receive new instructions at any time—potentially including commands to install additional malware, encrypt files, or establish deeper persistence mechanisms. The Myanmar activation guardrail also suggests state-sponsored or politically motivated operators, which typically employ more sophisticated evasion and anti-forensics techniques than commodity malware. Manual removal may eliminate visible components while leaving kernel-level rootkits, firmware implants, or credential-harvesting modules active.
Computer Repair Roswell maintains an isolated analysis bench specifically designed for malware investigation and removal. We can safely examine your system's behavior without risking further infection or data exfiltration, identify all persistence mechanisms including those hidden from standard Windows tools, and verify clean removal through behavioral analysis and memory forensics. We're located at 1330 Hembree Road in Roswell, Georgia—fifteen minutes from central Alpharetta and easily accessible from GA-400. Call us at (770) 869-0395 for same-day appointments. Bring your infected machine in, and we'll have it analyzed and cleaned within 24 hours in most cases, with our 90-day reinfection warranty protecting your investment.