China-Aligned TA415 Exploits Google Sheets & Calendar for C2

China-aligned TA415 has adopted Google Sheets and Google Calendar as covert command-and-control (C2) channels in a sustained espionage campaign targeting U.S. government, academic, and think-tank entities. By blending malicious operations into trusted cloud services, the group aims to evade detection and harvest intelligence on evolving U.S.–China economic policy discussions, with spearphishing campaigns run throughout July and August 2025.

The attackers used spoofed emails attributed to figures such as the Chair of the Select Committee on Strategic Competition and the U.S.–China Business Council, inviting targets to “closed-door briefings” and soliciting feedback on draft sanctions legislation; links pointed to password-protected archives hosted on Zoho WorkDrive, Dropbox and OpenDrive.

According to Proofpoint, TA415’s objective is to harvest intelligence on U.S. economic policy deliberations, sanctions planning, and legislative trajectories, while the WhirlCoil loader authenticates a VS Code Remote Tunnel via GitHub credentials, enabling shell-level access and data exfiltration.

Operational instructions and exfiltrated system information were reportedly stored in Google Sheets and Calendar events, with metadata such as Windows version, locale, computer name and user directories posted to free request-logging services.