Google Warns of Hackers Absing Calendar Service as a Covert C2 Channel

Google is warning of numerous danger actors sharing a community proof-of-strategy (PoC) exploit that leverages its Calendar company to host command-and-handle (C2) infrastructure.

The instrument, named Google Calendar RAT (GCR), employs Google Calendar Functions for C2 applying a Gmail account. It was very first revealed to GitHub in June 2023.

“The script generates a ‘Covert Channel’ by exploiting the party descriptions in Google Calendar,” in accordance to its developer and researcher, who goes by the on-line alias MrSaighnal. “The goal will join straight to Google.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The tech large, in its eighth Risk Horizons report, claimed it has not noticed the use of the tool in the wild, but mentioned its Mandiant danger intelligence device has observed sharing the PoC on underground discussion boards.

“GCR, working on a compromised device, periodically polls the Calendar celebration description for new commands, executes those people commands on the concentrate on unit, and then updates the occasion description with command output,” Google said.

The truth that the resource operates solely on respectable infrastructure helps make it tough for defenders to detect suspicious exercise, it added.

The enhancement highlights menace actors’ ongoing curiosity in abusing cloud services to mix in with target environments and fly under the radar.

This incorporates an Iranian nation-condition actor that was spotted employing macro-laced docs to compromise end users with a modest .NET backdoor codenamed BANANAMAIL for Windows that takes advantage of email for C2.

“The backdoor uses IMAP to connect to an attacker-controlled webmail account wherever it parses e-mails for commands, executes them, and sends again an email containing the benefits,” Google claimed.

Google’s Threat Analysis Team explained it has considering the fact that disabled the attacker-controlled Gmail accounts that ended up employed by the malware as a conduit.

Uncovered this write-up attention-grabbing? Observe us on Twitter  and LinkedIn to go through extra unique content we article.