In the world of cybersecurity, many types of malware require active surveillance from attackers once they enter the victim’s system. Hackers often create a “command and control” (C2) infrastructure to manage and communicate with the malware.

Traditionally these commands are sent through a dedicated C2 server. But cybercriminals have now found a way to hide their activities using legitimate services, including cloud storage and email platforms.

In the past, hackers used the following services:

• Dropbox,
• Amazon Web Services,
• google drive,
• Gmail.

With their help, they disguised commands for malware under the guise of normal Internet traffic. Such tactics have made it difficult for antivirus programs and cybersecurity experts to detect and counter attackers.

A new threat

Recently Google pointed out the potential risks associated with its use. Google Calendar As a new communication tool for C2 purposes. In its cybersecurity report on future threats, the company cites research conducted by an expert known by the pseudonym “MrSaighnal.”

This method is called Google Calendar RAT (GCR)involves embedding C2 commands in the description of calendar events. Malware installed by hackers regularly checks the Google Calendar account for new commands and starts executing them on the compromised device.

According to Google representatives, “GCR interacts only through the legal infrastructure managed by Google, making it difficult for defenders to detect suspicious activity.”

The discovery of this vulnerability in Google Calendar highlights ongoing problems in securing seemingly trustworthy digital services. This is a clear reminder to maintain current cybersecurity practices and be alert to any changes in software behavior.

Cybersecurity experts are now faced with the challenge of confronting this new threat and developing strategies to mitigate the risks associated with hackers using Google Calendar for malicious purposes.