APT41 Hackers Uses Google Calendar for Malware Command-and-Control Attack in Government Entities

APT41, a notorious Chinese state-sponsored threat actor, has escalated its arsenal of cyber-espionage tools by leveraging Google Calendar for command-and-control (C2) communications in attacks targeting government institutions.

This innovative method, recently documented through an incident on a Taiwanese government website, highlights the group’s capability to blend traditional espionage with advanced malware delivery and stealthy persistence mechanisms.

APT41, also tracked as BARIUM, Wicked Panda, and Brass Typhoon, has a decade-long history of targeting sectors ranging from healthcare and telecom to software and public sector entities globally.

Known for its dual focus state espionage and profit-driven cybercrime the group consistently demonstrates a high degree of technical proficiency and adaptability.

Multi-Stage Attack Initiation

The attack campaign was initiated via spear-phishing emails containing links to ZIP archives hosted on a compromised government domain.

According to Resecurity Report, these archives concealed a Windows shortcut (LNK) file, masquerading as a PDF document, alongside several image files among which “6.jpg” and “7.jpg” served as the primary malicious payloads.

Upon interaction, the LNK file executes a chain reaction: it first displays a decoy document before surreptitiously triggering malware deployment.

This custom malware, codenamed ToughProgress, unfolds in three modular stages:

• PLUSDROP: Decrypts one of the embedded malicious images and executes it via Rundll32.exe.
• PLUSINJECT: Employs process hollowing to inject the next stage into the memory space of a legitimate Windows process (svchost.exe), achieving both evasion and persistence.
• TOUGHPROGRESS: Responsible for establishing C2 using Google Calendar events.

These components employ advanced techniques such as in-memory execution, custom obfuscation, encrypted payloads, and dynamic API resolution to resist detection.

The malware’s operation is characterized by its deep interaction with Windows internals.

By traversing the Process Environment Block (PEB) to enumerate loaded modules, the malware sidesteps typical Windows APIs that are more readily monitored by security tools.

It further applies custom hashing to obscure its targets, making static detection challenging.

Additionally, the toolkit inspects and manipulates low-level operating system components, including ntoskrnl.exe, using memory pattern matching and dynamic kernel mapping reminiscent of rootkit behavior.

These steps facilitate privilege escalation, anti-forensics, and deep system persistence.

Google Calendar: The Unlikely C2 Channel

The hallmark of this operation is its novel abuse of Google Calendar for command-and-control.

Post-compromise, the TOUGHPROGRESS module interacts with attacker-controlled Google Calendar events, embedding and retrieving encrypted commands and exfiltrated data within calendar entries.

This method permits attackers to bypass traditional network defenses and evade anomaly detection systems by masquerading C2 traffic as legitimate cloud communications.

The strategy not only strengthens operational security for threat actors but also complicates response efforts for defenders, as cloud-based C2 channels are rarely blocked or monitored.

Following the disclosure of this activity, Google worked to counter the abuse by deploying custom detection heuristics, disabling malicious Workspace projects, and adding related domains and files to Safe Browsing blocklists.

Security researchers stress the need for defenders to monitor unusual usage of legitimate cloud collaboration tools and to expand visibility into outbound traffic toward known C2 infrastructure.

The continuing innovation in APT41’s TTPs underscores the importance of cloud-aware defense strategies and robust monitoring of both conventional and cloud infrastructure for government and enterprise networks worldwide.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Update