Google Calendar: Not Just for Events, but Also a Target for Hackers

Google has reported a risk associated with its Calendar service, warning that cybercriminals could exploit it as a command-and-control (C2) infrastructure to manage malware. In its latest cyber threat report, the company highlighted the spread of an exploit that leverages this service.

A tool called Google Calendar RAT (GCR) uses Google Calendar events for C2 operations via a Gmail account. Since June of this year, GCR has been publicly available on GitHub as a proof of concept (PoC), and real attackers have shown interest in it as well.

According to the tool’s developer, known as “MrSaighnal,” the script creates a “covert channel” by using the descriptions of Google Calendar events. The target connects directly to Google’s services.

Although there have been no confirmed attacks using this tool yet, experts from Mandiant, a Google-owned company, have observed hackers discussing GCR on underground forums.

Once installed on a compromised machine, GCR periodically checks calendar event descriptions for new commands, executes them, and updates the event description with the results, according to the company. Google also noted that the tool’s exclusive use of legitimate infrastructure makes it difficult for security systems to detect suspicious activity.

This case highlights the ongoing interest of cybercriminals in abusing legitimate cloud services to disguise malicious activity and bypass security mechanisms.

Other Recent Threats: Iranian Group Uses Email for Malware Control

Google’s report also described similar activity by an Iranian state-sponsored group, which used office documents with macros to deploy a .NET backdoor targeting Windows systems, codenamed BANANAMAIL. In this case, the malware used email as its C2 infrastructure.

“The backdoor uses the IMAP protocol to connect to a webmail account controlled by the attacker, scans emails for commands, executes them, and sends back an email with the results,” researchers explained.

Google’s Threat Analysis Group reported successfully blocking Gmail accounts controlled by attackers that were used by this malware.