"Google Exposes Potential Calendar Service Exploitation by Hackers as Covert C2 Channel"

Google has issued a warning about threat actors sharing a proof-of-concept exploit that utilizes its Calendar service as a command-and-control (C2) infrastructure. The tool, known as Google Calendar RAT (GCR), creates a covert channel by exploiting event descriptions in Google Calendar, making it difficult for defenders to detect suspicious activity. This highlights the ongoing interest of threat actors in abusing cloud services to blend in with victim environments. Google's Threat Analysis Group has disabled the attacker-controlled Gmail accounts used by the malware.