MeetC2 – A serverless C2 framework that leverages Google Calendar APIs as a communication channel

MeetC2 is a PoC C2 tool that uses Google Calendar to mimic cloud abuse, designed to help teams test detection, logging, and response. According to Security Affairs, it is a cross‑platform (macOS/Linux) application that demonstrates how legitimate cloud services can be abused for adversarial operations by creating a hidden communications channel via the Google Calendar API.

The framework polls the calendar every 30 seconds for new events containing commands, with the organiser posting commands as events to the calendar’s summary field, and the guest agent extracting and executing them locally before updating the event with output in the description field. The setup guides show how to configure a Google Cloud project and service account, share the calendar, and obtain credentials.json, calendar ID, and appropriate permissions.

MeetC2 also provides command line interactions for the organiser and guest hosts, including commands such as exec, list, get, and clear, to manage and retrieve command outputs. The project is hosted on GitHub at der iv-security/MeetC2, and the article notes OpSec considerations for the guest binary during testing. September 06, 2025.