Archive · 30 May 2025
Google Shuts Down APT41 Malware Using Google Calendar
A group of hackers used Google Calendar to steal information from people's computers.
They sent emails that looked harmless but contained a hidden program that installed malware.
This malware used Google Calendar to communicate with the hackers, sending them secret information from the infected computer.
The hackers would use calendar events to store stolen data.
Google found out and shut down the hackers' accounts, blocking their access and protecting users.
Google also notified affected organizations to help them secure their systems.
APT41, a group linked to China, used Google Calendar as a command and control channel for malware.
The malware was distributed through spear phishing emails containing links to a compromised government website.
Infected devices had their data extracted using encrypted data in calendar event descriptions.
Google's Threat Intelligence Group (GTIG) took down the hackers' calendar accounts and other systems.
Google updated its malware detection systems and blocked malicious domains and URLs.
- Who
- A China-linked hacking group (APT41).
- What
- Google shut down malware that used Google Calendar to steal data.
- When
- The malware was active, with key dates in 2023 and the discovery in October 2024.
- Where
- Devices infected with malware.
- Why
- To extract sensitive information from compromised devices.
- Hacking Group
- APT41 (HOODOO)
- Delivery Method
- Spear phishing
- C2 Channel
- Google Calendar
- Discovery Date
- October 2024
- Data Exfiltration
- Encrypted data in calendar event descriptions
- Key Dates
- May 30, July 30, July 31, 2023