Loading malware…
TOUGHPROGRESS is a Windows backdoor used by the PRC-linked cyber-espionage actor APT41 (also tracked as HOODOO). It was identified in campaigns targeting government entities, including campaigns that used a compromised government website and spearphishing links to distribute a multi-stage malware chain. APT41 has also targeted organizations in shipping and logistics, media and entertainment, technology, and automotive sectors. The infection chain uses PLUSDROP to decrypt and execute subsequent payloads in memory and PLUSINJECT to hollow a legitimate process before launching TOUGHPROGRESS. TOUGHPROGRESS receives commands, executes them on compromised hosts, and returns encrypted command results through Google Calendar events. It compresses and encrypts host data, commands, and results, allowing command-and-control traffic to blend with legitimate Google service activity. The malware and its delivery chain employ memory-resident execution, encryption, compression, process hollowing, masquerading, and control-flow obfuscation to hinder detection and analysis.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TOUGHPROGRESS executes actions on compromised hosts, using Google Calendar as a C2 channel.
...APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar for command-and-control (C2).
17 distinct techniques documented for this family, organized by ATT&CK tactic.
“each module [employed] advanced stealth techniques such as memory-only payloads, encryption, compression, process hollowing, control flow obfuscation.”
The archive contains an LNK file, masquerading as a PDF, and a directory. Within this directory we find what looks like seven JPG images... The files “6.jpg” and “7.jpg” are fake images.
The indicators include “申報物品清單.pdf.lnk,” a shortcut file presented with a PDF-looking filename.
“PLUSINJECT – launches and performs process hollowing on a legitimate ‘svchost.exe’ process to inject the final payload.”
PLUSINJECT - Launches and performs process hollowing on a legitimate “svchost.exe” process, injecting the final payload.
The first file is actually an encrypted payload and is decrypted by the second file... TOUGHPROGRESS begins by using a hardcoded 16-byte XOR key to decrypt embedded shellcode... The shellcode then decompresses a DLL in memory using COMPRESSION_FORMAT_LZNT1.
we confirmed Calendarwalk’s capabilities – a novel C2 mechanism that retrieves and executes commands via Google Calendar events.
“TOUGHPROGRESS – executes actions on the compromised hosts, using Google Calendar as a C2 channel.”
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware that abuses Google Calendar as a command-and-control channel; used in APT41 activity targeting government entities.
Backdoor used by APT41 that uses Google Calendar as a command-and-control channel; employs in-memory execution, encryption/compression, process hollowing, and obfuscation.
Modular malware/backdoor used by APT41, notable for its use of Google Calendar as a command-and-control (C2) channel, advanced evasion, and persistence techniques.
TOUGHPROGRESS is a backdoor malware that leverages Google Calendar for command-and-control, allowing attackers to read and write calendar events to issue commands and receive execution results.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.