Google uncovers malware marketing campaign by China-linked hackers utilizing Calendar occasions in a complicated cyberattack

In a regarding revelation, Google’s Menace Intelligence Group (GTIG) has uncovered {that a} group of hackers linked to China used Google Calendar as a instrument to steal delicate info from people. The group, often called APT41 or HOODOO, is believed to have ties to the Chinese language authorities.

Based on GTIG, the assault started with a spear phishing marketing campaign. This technique entails sending rigorously crafted emails to particular targets. These emails included a hyperlink to a ZIP file hosted on a compromised authorities web site. As soon as the sufferer opened the ZIP file, they’d discover a shortcut file disguised as a PDF and a folder with a number of pictures of bugs and spiders.

Nonetheless, two of those picture information have been pretend and truly contained malicious software program. When the sufferer clicked the shortcut, it triggered the malware and even changed itself with a pretend PDF that seemed to be about species export laws, more likely to keep away from suspicion.

The malware labored in three steps. First, it decrypted and ran a file named PLUSDROP within the laptop’s reminiscence. Then, it used a recognized Home windows course of to secretly run dangerous code. Within the ultimate stage, a program known as TOUGHPROGRESS carried out instructions and stole knowledge.

What made this assault uncommon was the usage of Google Calendar as a communication instrument. The malware created brief, zero-minute occasions on particular dates. These occasions included encrypted knowledge or directions hidden of their description subject. The malware repeatedly checked these calendar occasions for brand spanking new instructions from the hacker. After finishing a job, it could create one other occasion with the stolen info.

Google mentioned the marketing campaign was found in October 2024 after it discovered malware spreading from a compromised authorities web site. The tech firm has since shut down the calendar accounts utilized by the hackers and eliminated different elements of their on-line infrastructure.

To cease comparable assaults sooner or later, Google has improved its malware detection techniques and blocked the dangerous web sites concerned. It additionally alerted organisations which will have been affected and shared technical particulars to assist them reply and defend themselves.