For decades, the rule in IT security was simple: "Block traffic to dodgy websites in Russia or China". But what do you do when the attack comes from a source you use every day at the office? In 2026, the NANOREMOTE threat changed the rules of the game.
At Altanet Craiova we have seen a rise in these sophisticated attacks that use legitimate infrastructure (Google, Microsoft, Dropbox) to slip past the firewall unnoticed. It is as if the thief walked out of the bank wearing a police uniform.
How Does NANOREMOTE Work?
Most viruses try to communicate with the hacker's server ("Command & Control") to receive commands. Good antivirus software detects this connection and cuts it off.
NANOREMOTE is different. It does not connect to a dodgy server, but to a Google Drive, OneDrive or Dropbox account created by the hackers. Because your company allows employees to use these services, the traffic looks perfectly legitimate.
- Step 1: It infects the computer (through an email or a download).
- Step 2: It checks a text file in a public Google Drive account to receive commands (e.g. "Steal the passwords from Chrome").
- Step 3: It uploads the stolen data to the same Google Drive account, as encrypted files.
To your firewall, everything looks like an employee doing their job and saving documents to the cloud.
Why Is It So Dangerous for Businesses?
As a RAT (Remote Access Trojan), NANOREMOTE gives total control over the infected computer. The hacker can:
- See everything you type (Keylogging).
- Take screenshots.
- Activate the webcam and microphone.
- Use your computer to attack other customers.
How Do We Defend Ourselves If We Can't Block Google?
You cannot block access to Google Drive in a modern company, but you can change the way you look at security:
- HTTPS inspection (SSL Inspection): The firewall must "unwrap" encrypted data packets to see what is really inside them.
- Behavioural monitoring (EDR): A classic antivirus looks for signatures. An EDR (Endpoint Detection and Response) looks at behaviour: "Why is Notepad trying to connect to the internet?".
- Frequency analysis: A person does not upload files at fixed intervals of exactly 30 seconds. An automated script does.
This technique of using legitimate services is called "Living off the Land". To understand the technical concept, you can consult the definition in the Proofpoint References on Living off the Land tactics.
Conclusion
Security no longer means just high walls (a firewall), but smart surveillance cameras (behavioural monitoring). If your computer behaves strangely, even when it visits safe websites, ask for help.
Want to know whether your network is hiding such invisible threats? We offer next-generation EDR solutions and 24/7 monitoring IT services. Go to our contact page and scan your systems before it is too late.
This material is part of the Altanet educational series on digital safety. Want to know what other risks you are exposed to this year? See the Complete List of Cyber Threats in 2026.