MalwareUsed by 1 actor

Calendarwalk

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT41

Our latest research has uncovered a new malware variant named Calendarwalk (recently named TOUGHPROGRESS by Google). ... we confirmed Calendarwalk’s capabilities – a novel C2 mechanism that retrieves and executes commands via Google Calendar events.

via virusbulletinvirusbulletin.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

executed schtasks /create /tn winupdate /sc minute /mo 5 /tr "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /U C:\ProgramData\Microsoft.DRM.ApplicationServices.dll" /ru system /f

T1059.003Windows Command ShellEvidence1

A command to be executed via cmd.exe

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

the threat actor likely referenced or adapted the techniques described in the article to utilize Workflow Foundation XOML as a malware execution method.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

executed schtasks /create /tn winupdate /sc minute /mo 5 /tr "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /U C:\ProgramData\Microsoft.DRM.ApplicationServices.dll" /ru system /f

T1112Modify RegistryEvidence1

21 Registry management sub-command 1: List registry sub-command 2: Write registry value sub-command 3: Write registry key sub-command 4: Delete registry

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

executed schtasks /create /tn winupdate /sc minute /mo 5 /tr "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /U C:\ProgramData\Microsoft.DRM.ApplicationServices.dll" /ru system /f

T1134Access Token ManipulationEvidence1

20 Impersonate the specified process ... 23 Stop impersonation ... 24 Impersonate with logon domain/user/password

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

the backdoor is protected by compiler-level obfuscation. Strings in the backdoor are protected using XOR encryption and are decrypted during runtime.

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

the threat actor likely referenced or adapted the techniques described in the article to utilize Workflow Foundation XOML as a malware execution method.

T1134Access Token ManipulationEvidence1

20 Impersonate the specified process ... 23 Stop impersonation ... 24 Impersonate with logon domain/user/password

T1218System Binary Proxy ExecutionEvidence1

Calendarwalk employs tactics not previously observed within the APT landscape, such as abusing LOTS through Google Calendar events and exploiting LOLBins via Windows Workflow Foundation.

T1218.004InstallUtilEvidence1

executing InstallUtil.exe to ‘uninstall’ the ConfuserEx-obfuscated .NET assembly – when, in reality, the Uninstall implementation triggers the loader mechanism.

T1497Virtualization/Sandbox EvasionEvidence1

Anti-debug checks - Retrieves COM object with a non-existent CLSID - IsDebuggerPresent() API call - Checks if memory size exceeds 3GB - Checks process names for ida.exe, ida64.exe, x32dbg.exe, x64dbg.exe, x96dbg.exe

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

21 Registry management sub-command 1: List registry sub-command 2: Write registry value sub-command 3: Write registry key sub-command 4: Delete registry

T1222File and Directory Permissions ModificationEvidence1

6 Move file 7 Copy file 8 Delete file/directory 9 Create directory

Discovery

6 techniques

T1016System Network Configuration DiscoveryEvidence1

The data fields are separated by the pipe (|) character and include the following: • WAN IP (retrieved via api.ipify.org) • LAN IP

T1033System Owner/User DiscoveryEvidence1

The data fields are separated by the pipe (|) character and include the following: • Username

T1057Process DiscoveryEvidence1

18 List process information

T1082System Information DiscoveryEvidence1

The data fields are separated by the pipe (|) character and include the following: • Computer name • Processor architecture • Boot time • Execution path • OS version • Domain group

T1083File and Directory DiscoveryEvidence1

4 List files

T1497Virtualization/Sandbox EvasionEvidence1

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

the attacker retrieved several files from a third compromised system via a UNC network share: Diagnosis.exe, DeElevator64.dll, and win.log.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

we confirmed Calendarwalk’s capabilities – a novel C2 mechanism that retrieves and executes commands via Google Calendar events.

T1102Web ServiceEvidence1

Calendarwalk employs tactics not previously observed within the APT landscape, such as abusing LOTS through Google Calendar events

T1105Ingress Tool TransferEvidence1

The loader is configured to retrieve and load its next-stage payload from C:\ProgramData\USOPrivate.dat.

T1132Data EncodingEvidence1

The encrypted payload is embedded in the event description field and is stored in hex-encoded format.

Impact

1 technique

T1489Service StopEvidence1

19 Kill process by PID

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

virusbulletinNews

Sep 24, 2025

Google Calendar As C2 Infrastructure: A China-Nexus Campaign With Stealthy Tactics

A multi-stage, heavily obfuscated backdoor that uses Google Calendar as command-and-control infrastructure. It collects victim information, uploads it in encrypted form, polls calendar events for commands, and supports file, process, registry, impersonation, and cross-session execution functions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Calendarwalk

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT41

via virusbulletinvirusbulletin.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

executed schtasks /create /tn winupdate /sc minute /mo 5 /tr "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /U C:\ProgramData\Microsoft.DRM.ApplicationServices.dll" /ru system /f

T1059.003Windows Command ShellEvidence1

A command to be executed via cmd.exe

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

the threat actor likely referenced or adapted the techniques described in the article to utilize Workflow Foundation XOML as a malware execution method.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

executed schtasks /create /tn winupdate /sc minute /mo 5 /tr "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /U C:\ProgramData\Microsoft.DRM.ApplicationServices.dll" /ru system /f

T1112Modify RegistryEvidence1

21 Registry management sub-command 1: List registry sub-command 2: Write registry value sub-command 3: Write registry key sub-command 4: Delete registry

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

executed schtasks /create /tn winupdate /sc minute /mo 5 /tr "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /U C:\ProgramData\Microsoft.DRM.ApplicationServices.dll" /ru system /f

T1134Access Token ManipulationEvidence1

20 Impersonate the specified process ... 23 Stop impersonation ... 24 Impersonate with logon domain/user/password

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

the backdoor is protected by compiler-level obfuscation. Strings in the backdoor are protected using XOR encryption and are decrypted during runtime.

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

the threat actor likely referenced or adapted the techniques described in the article to utilize Workflow Foundation XOML as a malware execution method.

T1134Access Token ManipulationEvidence1

20 Impersonate the specified process ... 23 Stop impersonation ... 24 Impersonate with logon domain/user/password

T1218System Binary Proxy ExecutionEvidence1

Calendarwalk employs tactics not previously observed within the APT landscape, such as abusing LOTS through Google Calendar events and exploiting LOLBins via Windows Workflow Foundation.

T1218.004InstallUtilEvidence1

executing InstallUtil.exe to ‘uninstall’ the ConfuserEx-obfuscated .NET assembly – when, in reality, the Uninstall implementation triggers the loader mechanism.

T1497Virtualization/Sandbox EvasionEvidence1

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

21 Registry management sub-command 1: List registry sub-command 2: Write registry value sub-command 3: Write registry key sub-command 4: Delete registry

T1222File and Directory Permissions ModificationEvidence1

6 Move file 7 Copy file 8 Delete file/directory 9 Create directory

Discovery

6 techniques

T1016System Network Configuration DiscoveryEvidence1

The data fields are separated by the pipe (|) character and include the following: • WAN IP (retrieved via api.ipify.org) • LAN IP

T1033System Owner/User DiscoveryEvidence1

The data fields are separated by the pipe (|) character and include the following: • Username

T1057Process DiscoveryEvidence1

18 List process information

T1082System Information DiscoveryEvidence1

The data fields are separated by the pipe (|) character and include the following: • Computer name • Processor architecture • Boot time • Execution path • OS version • Domain group

T1083File and Directory DiscoveryEvidence1

4 List files

T1497Virtualization/Sandbox EvasionEvidence1

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

the attacker retrieved several files from a third compromised system via a UNC network share: Diagnosis.exe, DeElevator64.dll, and win.log.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

we confirmed Calendarwalk’s capabilities – a novel C2 mechanism that retrieves and executes commands via Google Calendar events.

T1102Web ServiceEvidence1

Calendarwalk employs tactics not previously observed within the APT landscape, such as abusing LOTS through Google Calendar events

T1105Ingress Tool TransferEvidence1

The loader is configured to retrieve and load its next-stage payload from C:\ProgramData\USOPrivate.dat.

T1132Data EncodingEvidence1

The encrypted payload is embedded in the event description field and is stored in hex-encoded format.

Impact

1 technique

T1489Service StopEvidence1

19 Kill process by PID

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

virusbulletinNews

Sep 24, 2025

Google Calendar As C2 Infrastructure: A China-Nexus Campaign With Stealthy Tactics

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.