https://feed.craftedsignal.io/tags/c2/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 21 Mar 2026 00:00:00 +0000https://feed.craftedsignal.io/briefs/2026-03-calendar-c2/Sat, 21 Mar 2026 00:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-03-calendar-c2/A China-nexus threat actor is utilizing Google Calendar as a command and control (C2) infrastructure to conduct stealthy operations.A China-nexus threat actor has been observed leveraging Google Calendar as a novel command and control (C2) mechanism. This campaign, observed starting in 2025, uses calendar entries to relay commands to compromised hosts. The use of Google Calendar allows the attacker to blend in with legitimate network traffic, evade traditional C2 detection methods, and maintain persistence. The stealthy nature of this approach makes it difficult to detect and attribute. This technique is particularly concerning because it leverages a common and trusted service, making it harder to differentiate between legitimate and malicious activity. The scope of targeting is currently unknown, but the use of advanced C2 infrastructure suggests a sophisticated and potentially widespread campaign.

Attack Chain

1. Initial compromise occurs through an unknown vector, potentially exploiting vulnerabilities or using social engineering.
2. A lightweight agent is installed on the target system. This agent is responsible for interacting with the Google Calendar API.
3. The agent authenticates to a pre-configured Google account controlled by the attacker using stolen or pre-configured credentials.
4. The agent periodically polls the Google Calendar API for new calendar events.
5. The attacker creates calendar events containing base64-encoded commands.
6. The agent retrieves the calendar event, decodes the command, and executes it on the compromised system.
7. The agent transmits the results of the executed command back to the attacker, potentially through another Google service or a separate channel.
8. The attacker uses the C2 channel to perform further actions, such as lateral movement, data exfiltration, or deployment of additional malware.

Impact

Compromised systems could be leveraged for a variety of malicious activities, including data theft, espionage, and disruption of services. The use of Google Calendar as a C2 channel makes attribution challenging and allows the attacker to maintain a persistent presence on the compromised network. Successful attacks could lead to significant financial losses, reputational damage, and loss of sensitive information. The number of victims and specific sectors targeted are currently unknown.

Recommendation

• Monitor API calls to googleapis.com for unusual patterns or unauthorized access attempts, specifically looking for calendar event modifications from unusual user agents (reference: Attack Chain step 4).
• Implement the Sigma rule to detect processes making modifications to Google Calendar.
• Enable and review Google Workspace audit logs for suspicious calendar activity, including event creation and modification from unexpected locations or accounts (reference: Attack Chain step 5).

]]>highthreatgoogle-calendarc2china-nexushttps://feed.craftedsignal.io/briefs/2024-01-iranian-botnet/Tue, 17 Mar 2026 19:15:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-iranian-botnet/An Iranian botnet operation utilizing a 15-node relay network and active C2 infrastructure was exposed through an open directory.A blog post on hunt.io details an Iranian botnet operation discovered through an open directory. The operation involves a 15-node relay network, suggesting a focus on obfuscation and resilience. The existence of an active Command and Control (C2) infrastructure indicates ongoing malicious activity. The exposure of these details allows defenders to gain insights into the botnet’s architecture and potentially disrupt its operations. While the specific targeting and malware used remain unclear from this report, the network structure points to a potentially sophisticated actor capable of conducting sustained campaigns. Understanding the C2 communication patterns and relay node infrastructure is crucial for effective defense.

Attack Chain

1. Initial Compromise: Systems are compromised through an unknown initial access vector.
2. Bot Installation: A bot payload is installed on the compromised systems.
3. C2 Communication: The bots establish communication with the C2 server to receive commands.
4. Relay Network Activation: Bots connect to one another creating the 15-node relay network.
5. Command Execution: The C2 server issues commands to the bots through the relay network.
6. Malicious Activity: Bots execute malicious commands, the specific actions are currently unknown.

Impact

The impact of this botnet is currently unknown due to limited information, but botnets are commonly used for DDoS attacks, spam campaigns, or credential stuffing. If the botnet successfully conducts its objectives it could lead to service disruptions, data breaches, or further compromise of systems within targeted networks. The Iranian origin suggests potential geopolitical motivations.

Recommendation

• Monitor network traffic for connections to the domain hunt.io as it is related to the botnet operation ([IOC: hunt.io]).
• Implement a network connection rule to detect unusual network connections that could indicate the C2 activity or relay network behavior.
• Investigate any systems that show signs of unusual network activity or communication with external domains.

]]>mediumadvisorybotnetiranC2