Google Warns of Hackers Absing Calendar Service as a Covert C2 Channel

Google is warning of numerous danger actors sharing a community proof-of-strategy (PoC) exploit that leverages its Calendar company to host command-and-handle (C2) infrastructure.

The instrument, named Google Calendar RAT (GCR), employs Google Calendar Functions for C2 applying a Gmail account. It was very first revealed to GitHub in June 2023.

“The script generates a ‘Covert Channel’ by exploiting the party descriptions in Google Calendar,” in accordance to its developer and researcher, who goes by the on-line alias MrSaighnal. “The goal will join straight to Google.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The tech large, in its eighth Risk Horizons report, claimed it has not noticed the use of the tool in the wild, but mentioned its Mandiant danger intelligence device has observed sharing the PoC on underground discussion boards.

“GCR, working on a compromised device, periodically polls the Calendar celebration description for new commands, executes those people commands on the concentrate on unit, and then updates the occasion description with command output,” Google said.

The truth that the resource operates solely on respectable infrastructure helps make it tough for defenders to detect suspicious exercise, it added.

The enhancement highlights menace actors’ ongoing curiosity in abusing cloud services to mix in with target environments and fly under the radar.

This incorporates an Iranian nation-condition actor that was spotted employing macro-laced docs to compromise end users with a modest .NET backdoor codenamed BANANAMAIL for Windows that takes advantage of email for C2.

“The backdoor uses IMAP to connect to an attacker-controlled webmail account wherever it parses e-mails for commands, executes them, and sends again an email containing the benefits,” Google claimed.

Google’s Threat Analysis Team explained it has considering the fact that disabled the attacker-controlled Gmail accounts that ended up employed by the malware as a conduit.

Uncovered this write-up attention-grabbing? Observe us on Twitter  and LinkedIn to go through extra unique content we article.