Google Calendar RAT Abusing Calendar Events to Create Red Teaming Infrastructure

Google Calendar RAT (GCR) is a proof of thought for Expose & Protect watch over (C2) by Google Calendar Events. It’s essential when constructing a chunky red group infrastructure is bright.

GCR needs a Gmail story, using occasion descriptions in Google Calendar as a “Covert Channel” for order connections to Google. Moreover this, it acts as a layer 7 application called Covert Channel, as reported by its developer and researcher, Mr. Saighnal (aka Valerio Alessandroni).

When GCR is running on a pc that has been hacked, it assessments the calendar occasion description for unique commands every so in most cases. It then runs these commands on the target tool and provides the outcomes of the commands to the occasion description. In accordance with what the coder talked about, GCR only talks by official Google infrastructure, which makes it bright for defenders to region unfamiliar conduct, Google talked about.

GCR Workflow

The red teaming tool uses Google Calendar events for C2. The tool permits an attacker to region commands in the occasion description field of Google Calendar events.

GCR connects to a shared Google Calendar link, assessments for pending commands, and creates a brand unique one “whoami” if none exist.

In the beneath image, the total GCR workflow assault is presented:

Whereas apart from this, each occasion contains two ingredients, and here we possess talked about them:-

• The Title incorporates a selected ID allowing a pair of commands for scheduling beneath the identical ID.

• The speed sing and its base64-encoded output are contained in the outline and are separated by “|”.

Furthermore, the connections seem like completely real on story of they’re diminutive to Google’s servers in terms of networking.

How produce I exploit it?

Here beneath, we possess talked about the total steps to use it:-

• First of all, uncover a Google provider story, uncover the credentials.json file, and place it in the script’s directory.
• Carry out a brand unique Google calendar, fragment it with the provider story, and change the script with your calendar take care of.
• It robotically creates an occasion with a optimistic target ID and runs the “whoami” sing when it’s speed on the target device.
• Now, in the communique’s occasion description, make sure to use the following syntax:-

=> CLEAR_COMMAND|BASE64_OUTPUT

Earlier, Google TAG seen an Iran-linked APT community using Gmail for C2 with a small .NET backdoor, BANANAMAIL, in March 2023. Moreover this, by IMAP the backdoor assessments electronic mail accounts for the execution of commands.

We haven’t considered GCR aged in real existence but, however Mandiant has considered a pair of avid gamers fragment the public proof of thought on underground sites. Google talked about by a threat document that folk are unexcited drawn to abusing cloud companies.

Furthermore Read:

A Recent Malware That Hides In The Linux Calendar Gadget on February 31st

What’s Crimson Teaming, Tactics & How Does it Works?