Hackers have found a way to exploit Google Calendar as a command & control (C2) infrastructure, causing concern in the cybersecurity community. This poses a major challenge as cybercriminals struggle to execute commands with malware on infected endpoints.

Traditionally, compromised servers are used as C2 infrastructure, but this is often quickly discovered and terminated by security professionals. However, leveraging legitimate resources like Google Calendar makes it much harder for cybersecurity pros to detect and terminate the attack.

Google has warned that a proof-of-concept (PoC) exploit called “Google Calendar RAT” (GCR) is circulating on the dark web. The script creates a “covert channel” by exploiting event descriptions in the calendar, and when devices are infected, they poll the calendar event description for new commands and run them, updating the event description with new command output.

While hackers haven’t been observed abusing GCR in the wild yet, the increasing use of legitimate cloud services to deliver malware is a growing concern. For example, Google Docs share feature allows malicious links to be distributed via email inboxes, bypassing email protection services.

This development is a significant concern for the cybersecurity community and highlights the need for enhanced protection measures against these increasingly sophisticated hacker tactics. (Reference: TheHackerNews)