MARK YOUR CALENDAR: APT41 INNOVATIVE TACTICS

Summary from the TLDR InfoSec newsletter

Google's Threat Intelligence Group discovered APT41 using the "TOUGHPROGRESS" malware, which exploits Google Calendar for command and control communications. The malware is delivered through spear-phishing emails containing ZIP archives hosted on compromised government websites. To evade detection, the malware uses a three-stage infection chain (PLUSDROP, PLUSINJECT, and TOUGHPROGRESS) with advanced obfuscation techniques, including 64-bit register overflow and control flow obfuscation. Google disrupted the campaign by developing custom detection signatures, terminating attacker-controlled Calendar accounts and Workspace projects, and adding malicious domains to Safe Browsing blocklists.