Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdf
Excerpt
Tim Chen & Still Hsu
TeamT5, Taiwan
timc@teamt5.org
still@teamt5.org
24 - 26 September, 2025 / Berlin, Germany
www.virusbulletin.com
GOOGLE CALENDAR AS C2 INFRASTRUCTURE: A CHINA-NEXUS CAMPAIGN... CHEN & HSU
2 VIRUS BULLETIN CONFERENCE SEPTEMBER 2025
ABSTRACT
In recent years, China-nexus threat groups have increasingly adopted tactics to obscure their malware footprint, particularly through the use of LOTS (living off trusted sites) and LOLBins (living-off-the-land binaries and scripts). Our latest research has uncovered a new malware variant named Calendarwalk (recently named TOUGHPROGRESS by Google).
Calendarwalk employs tactics not previously observed within the APT landscape, such as abusi…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Virus Bulletin on virusbulletin.com.
Mentioned in the excerpt
More from Virus Bulletin10
- Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdfVirus Bulletin · Added 29 Jan
- DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdfVirus Bulletin · Added 16 Oct 2025
- Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdfVirus Bulletin · Added 15 Jan 2025
- The-Mask-has-been-unmasked-again.pdfVirus Bulletin · Added 17 Dec 2024
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
