Google GTIG disrupts APT41 TOUGHPROGRESS Google-Calendar-C2 campaign

Summary

Google Threat Intelligence Group (Mandiant) documented APT41 (HOODOO) abusing Google Calendar as a covert command-and-control channel for a multi-stage implant family it named TOUGHPROGRESS, delivered via spear-phishing ZIPs hosted on a compromised government website. The lure masqueraded as an export-declaration document and chained a disguised LNK, an image-decoded payload, and a DLL loader. Google disrupted the campaign by fingerprinting and terminating the attacker-controlled Calendars and Workspace projects.

Tags

Primary source