Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanese government website. Their attack chain involves spear-phishing emails, malicious ZIP archives, and a three-module malware system called ToughProgress. This malware uses stealthy techniques like in-memory execution, encryption, and process hollowing to evade detection. The unique aspect of ToughProgress is its use of Google Calendar events for covert data exchange, creating a stealthy communication channel for remote command execution and data exfiltration.

APT41 is a sophisticated Chinese state-sponsored threat actor known for blending cyber espionage with financially motivated cybercrime tactics. This group targets a wide range of sectors globally, including healthcare, telecommunications, and government entities, leveraging advanced and stealthy malware to achieve their objectives. The recent activity highlighted involves the use of a novel malware family called ToughProgress, which employs a multi-stage attack chain beginning with spear-phishing emails containing malicious ZIP archives. Upon successful infection, ToughProgress operates through a three-module system that uses advanced evasion techniques such as in-memory execution to avoid writing payloads to disk, encryption to protect its communications and payloads, and process hollowing to masquerade as legitimate processes, thereby evading detection by traditional security tools. A particularly unique and innovative aspect of this malware is its use of Google Calendar events as a covert command-and-control (C2) channel. By embedding commands and exfiltrated data within calendar events, the malware establishes a stealthy and resilient communication method that blends into normal network traffic, making detection and disruption more challenging. This technique allows the attacker to remotely execute commands and exfiltrate sensitive data without raising typical network security alarms. The attack was notably observed targeting a Taiwanese government website, indicating a focus on high-value geopolitical targets. The tactics, techniques, and procedures (TTPs) employed by APT41 include spear-phishing (T1566.001), use of living-off-the-land binaries (T1218.011), process hollowing (T1055.012), and covert channel communications (T1102.003), among others, demonstrating a high level of operational sophistication and adaptability. Although no known exploits in the wild have been reported for this specific malware, the threat actor’s history and capabilities suggest a persistent and evolving risk to targeted organizations.

MD5 of 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360

MD5 of 151257e9dfda476cdafd9983266ad3255104d72a66f9265caa8417a5fe1df5d7

MD5 of 3b88b3efbdc86383ee9738c92026b8931ce1c13cd75cd1cda2fa302791c2c4fb

MD5 of 469b534bec827be03c0823e72e7b4da0b84f53199040705da203986ef154406a

SHA1 of 469b534bec827be03c0823e72e7b4da0b84f53199040705da203986ef154406a

SHA1 of 3b88b3efbdc86383ee9738c92026b8931ce1c13cd75cd1cda2fa302791c2c4fb

SHA1 of 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360

SHA1 of 151257e9dfda476cdafd9983266ad3255104d72a66f9265caa8417a5fe1df5d7

Detailed information about APT 41: Threat Intelligence Report and Malware Analysis. Get real-time updates, technical details, and mitigation strategies.

APT 41: Threat Intelligence Report and Malware Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

APT 41: Threat Intelligence Report and Malware Analysis

In late October 2024, a government website was discovered hosting malware targeting multiple government entities. The malware, dubbed TOUGHPROGRESS, utilized Google Calendar for command and control. Attributed to APT41, a PRC-based actor, the campaign targeted global organizations in various sectors. The malware infection chain involved three modules: PLUSDROP, PLUSINJECT, and TOUGHPROGRESS, employing stealth and evasion techniques. TOUGHPROGRESS used encrypted Calendar events for communication. Google Threat Intelligence Group disrupted the campaign by developing custom fingerprints, terminating attacker-controlled infrastructure, and updating Safe Browsing. APT41 has been observed using free web hosting tools and URL shorteners for malware distribution since August 2024. The blog post provides indicators of compromise and YARA rules to aid in detection and defense against similar attacks.

In late October 2024, a sophisticated malware campaign attributed to APT41, a China-based advanced persistent threat group, was discovered targeting multiple government entities globally. The malware, named TOUGHPROGRESS, employs an innovative command and control (C2) mechanism leveraging Google Calendar events, which are encrypted to evade detection and maintain stealthy communication with infected hosts. The infection chain consists of three distinct modules: PLUSDROP, PLUSINJECT, and TOUGHPROGRESS. PLUSDROP likely serves as the initial dropper, delivering the payload; PLUSINJECT is used for code injection to maintain persistence and evade security controls; and TOUGHPROGRESS handles encrypted C2 communications via Google Calendar, a novel tactic that complicates traditional network-based detection methods. The campaign also utilizes free web hosting services and URL shorteners for malware distribution, enhancing operational security and complicating attribution. Google Threat Intelligence Group intervened by creating custom detection fingerprints, dismantling attacker infrastructure, and updating Safe Browsing protections to mitigate the threat. Indicators of compromise include specific file hashes and malicious domains hosted on Cloudflare's trycloudflare.com subdomains. The malware employs multiple evasion and stealth techniques, including encrypted communications (MITRE T1573.001), code injection (T1055.012), and use of legitimate services for C2 (T1102), reflecting a high level of operational sophistication. The campaign targets government websites and entities, indicating a focus on espionage and information gathering. No known exploits in the wild have been reported, and no affected software versions are specified, suggesting the attack vector is likely through social engineering or supply chain compromises rather than exploiting a specific software vulnerability. The campaign's medium severity rating reflects its targeted nature and complexity, balanced against the lack of widespread exploitation or direct destructive payloads reported to date.

Detailed information about Mark Your Calendar: APT41 Innovative Tactics. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'google calendar'

Filter Threats

Threats Tagged 'google calendar'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility