Mark Your Calendar: APT41 Innovative Tactics
Written by: Patrick Whitsell
Google Threat Intelligence Group’s (GTIG) mission is to protect Google’s billions of users and Google’s multitude of products and services. In late October 2024, GTIG discovered an exploited government website hosting malware being used to target multiple other government entities. The exploited site delivered a malware payload, which we have dubbed “TOUGHPROGRESS”, that took advantage of Google Calendar for command and control (C2). Misuse of cloud services for C2 is a technique that many threat actors leverage in order to blend in with legitimate activity.
We assess with high confidence that this malware is being used by the PRC based actor APT41 (also tracked as HOODOO). APT41’s targets span the globe, including governments and organizations within the global shipping and logistics, media and entertainment, technology, and automotive sectors.
OverviewIn this blog post we analyze the malware delivery methods, technical details of the malware attack chain, discuss other recent APT41 activities, and share indicators of compromise (IOCs) to help security practitioners defend against similar attacks. We also detail how GTIG disrupted this campaign using custom detection signatures, shutting down attacker-controlled infrastructure, and protections added to Safe Browsing.
Figure 1: TOUGHPROGRESS campaign overview
DeliveryAPT41 sent spear phishing emails containing a link to the ZIP archive hosted on the exploited government website. The archive contains an LNK file, masquerading as a PDF, and a directory. Within this directory we find what looks like seven JPG images of arthropods. When the payload is executed via the LNK, the LNK is deleted and replaced with a decoy PDF file that is displayed to the user indicating these species need to be declared for export.
$ unzip -l 出境海關申報清單.zip Length Date Time Name --------- ---------- ----- ---- 0 2024-10-23 11:00 image/ 12633 2024-10-23 10:53 image/1.jpg 10282 2024-10-23 10:54 image/2.jpg 8288 2024-10-23 10:54 image/3.jpg 4174 2024-10-23 10:54 image/4.jpg 181656 2024-10-23 10:54 image/5.jpg 997111 2024-10-23 11:00 image/6.jpg 124928 2024-10-23 11:00 image/7.jpg 88604 2024-10-23 11:03 申報物品清單.pdf.lnk --------- ------- 1427676 9 filesThe files “6.jpg” and “7.jpg” are fake images. The first file is actually an encrypted payload and is decrypted by the second file, which is a DLL file launched when the target clicks the LNK.
Malware Infection ChainThis malware has three distinct modules, deployed in series, each with a distinct function. Each module also implements stealth and evasion techniques, including memory-only payloads, encryption, compression, process hollowing, control flow obfuscation, and leveraging Google Calendar for C2.
-
PLUSDROP - DLL to decrypt and execute the next stage in memory.
-
PLUSINJECT - Launches and performs process hollowing on a legitimate “svchost.exe” process, injecting the final payload.
-
TOUGHPROGRESS - Executes actions on the compromised Windows host. Uses Google Calendar for C2.
TOUGHPROGRESS begins by using a hardcoded 16-byte XOR key to decrypt embedded shellcode stored in the sample’s “.pdata” region. The shellcode then decompresses a DLL in memory using COMPRESSION_FORMAT_LZNT1. This DLL layers multiple obfuscation techniques to obscure the control flow.
-
Register-based Indirect Calls
-
Dynamic Address Arithmetic
-
64-bit register overflow
-
Function Dispatch Table
The registered-based indirect call is used after dynamically calculating the address to store in the register. This calculation involves two or more hardcoded values that intentionally overflow the 64-bit register. Here is an example calling CreateThread.
Figure 2: Register-based indirect call with dynamic address arithmetic and 64-bit overflow
We can reproduce how this works using Python “ctypes” to simulate 64-bit register arithmetic. Adding the two values together overflows the 64-bit address space and the result is the address of the function to be called.
Figure 3: Demonstration of 64-bit address overflow
Figure 4: CreateThread in Dispatch Table
These obfuscation techniques manifest as a Control Flow Obfuscation tactic. Due to the indirect calls and arithmetic operations, the disassembler cannot accurately recreate a control flow graph.
Calendar C2TOUGHPROGRESS has the capability to read and write events with an attacker-controlled Google Calendar. Once executed, TOUGHPROGRESS creates a zero minute Calendar event at a hardcoded date, 2023-05-30, with data collected from the compromised host being encrypted and written in the Calendar event description.
The operator places encrypted commands in Calendar events on 2023-07-30 and 2023-07-31, which are predetermined dates also hardcoded into the malware. TOUGHPROGRESS then begins polling Calendar for these events. When an event is retrieved, the event description is decrypted and the command it contains is executed on the compromised host. Results from the command execution are encrypted and written back to another Calendar event.
In collaboration with the Mandiant FLARE team, GTIG reverse engineered the C2 encryption protocol leveraged by TOUGHPROGRESS. The malware uses a hardcoded 10-byte XOR key and generates a per-message 4-byte XOR key.
-
Compress message with LZNT1
-
Encrypt the message with a 4-byte XOR key
-
Append the 4-byte key at the end of a message header (10 bytes total)
-
Encrypt the header with the 10-byte XOR key
-
Prepend the encrypted header to the front of the message
-
The combined encrypted header and message is the Calendar event description
Figure 5: TOUGHPROGRESS encryption routine for Calendar Event Descriptions
Figure 6: Example of a Calendar event created by TOUGHPROGRESS
Disrupting Attackers to Protect Google, Our Users, and Our CustomersGTIG’s goal is not just to monitor threats, but to counter and disrupt them. At Google, we aim to protect our users and customers at scale by proactively blocking malware campaigns across our products.
To disrupt APT41 and TOUGHPROGRESS malware, we have developed custom fingerprints to identify and take down attacker-controlled Calendars. We have also terminated attacker-controlled Workspace projects, effectively dismantling the infrastructure that APT41 relied on for this campaign. Additionally, we updated file detections and added malicious domains and URLs to the Google Safe Browsing blocklist.
In partnership with Mandiant Consulting, GTIG notified the compromised organizations. We provided the notified organizations with a sample of TOUGHPROGRESS network traffic logs, and information about the threat actor, to aid with detection and incident response.
Protecting Against Ongoing ActivityGTIG has been actively monitoring and protecting against APT41’s attacks using Workspace apps for several years. This threat group is known for their creative malware campaigns, sometimes leveraging Workspace apps.
-
Google Cloud’s Office of the CISO published the April 2023 Threat Horizons Report detailing HOODOO’s use of Google Sheets and Google Drive for malware C2.
-
In October 2024, Proofpoint published a report attributing the VOLDEMORT malware family to APT41.
-
The DUSTTRAP malware family, reported by GTIG and Mandiant in July of 2024, used Public Cloud hosting for C2.
In each case, GTIG identified and terminated the attacker-controlled Workspace projects and infrastructure APT41 relied on for these campaigns.
Free Web Hosting InfrastructureSince at least August 2024, we have observed APT41 using free web hosting tools for distributing their malware. This includes VOLDEMORT, DUSTTRAP, TOUGHPROGRESS and likely other payloads as well. Links to these free hosting sites have been sent to hundreds of targets in a variety of geographic locations and industries.
APT41 has used Cloudflare Worker subdomains the most frequently. However, we have also observed use of InfinityFree and TryCloudflare. The specific subdomains and URLs here have been observed in previous campaigns, but may no longer be in use by APT41.
Cloudflare Workers-
word[.]msapp[.]workers[.]dev
-
cloud[.]msapp[.]workers[.]dev
-
term-restore-satisfied-hence[.]trycloudflare[.]com
-
ways-sms-pmc-shareholders[.]trycloudflare[.]com
-
resource[.]infinityfreeapp[.]com
-
pubs[.]infinityfreeapp[.]com
APT41 has also been observed using URL shorteners in their phishing messages. The shortened URL redirects to their malware hosted on free hosting app subdomains.
-
https[:]//lihi[.]cc/6dekU
-
https[:]//tinyurl[.]com/hycev3y7
-
https[:]//my5353[.]com/nWyTf
-
https[:]//reurl[.]cc/WNr2Xy
All domains and URLs in this blog post have been added to the Safe Browsing blocklist. This enables a warning on site access and prevents users from downloading the malware.
Indicators of CompromiseThe IOCs in this blog post are also available as a collection in Google Threat Intelligence.
Hashes
Name
Hashes (SHA256 / MD5)
出境海關申報清單.zip
469b534bec827be03c0823e72e7b4da0b84f53199040705da203986ef154406a 876fb1b0275a653c4210aaf01c2698ec
申報物品清單.pdf.lnk
3b88b3efbdc86383ee9738c92026b8931ce1c13cd75cd1cda2fa302791c2c4fb 65da1a9026cf171a5a7779bc5ee45fb1
6.jpg
50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360 1ca609e207edb211c8b9566ef35043b6
7.jpg
151257e9dfda476cdafd9983266ad3255104d72a66f9265caa8417a5fe1df5d7 2ec4eeeabb8f6c2970dcbffdcdbd60e3
Domains-
word[.]msapp[.]workers[.]dev
-
cloud[.]msapp[.]workers[.]dev
-
term-restore-satisfied-hence[.]trycloudflare[.]com
-
ways-sms-pmc-shareholders[.]trycloudflare[.]com
-
resource[.]infinityfreeapp[.]com
-
pubs[.]infinityfreeapp[.]com
-
https[:]//lihi[.]cc/6dekU
-
https[:]//lihi[.]cc/v3OyQ
-
https[:]//lihi[.]cc/5nlgd
-
https[:]//lihi[.]cc/edcOv
-
https[:]//lihi[.]cc/4z5sh
-
https[:]//tinyurl[.]com/mr42t4yv
-
https[:]//tinyurl[.]com/hycev3y7
-
https[:]//tinyurl[.]com/mpa2c5wj
-
https[:]//tinyurl[.]com/3wnz46pv
-
https[:]//my5353[.]com/ppOH5
-
https[:]//my5353[.]com/nWyTf
-
https[:]//my5353[.]com/fPUcX
-
https[:]//my5353[.]com/ZwEkm
-
https[:]//my5353[.]com/vEWiT
-
https[:]//reurl[.]cc/WNr2Xy
-
104075625139-l53k83pb6jbbc2qbreo4i5a0vepen41j.apps.googleusercontent.com
-
https[:]//www[.]googleapis[.]com/calendar/v3/calendars/ff57964096cadc1a8733cf566b41c9528c89d30edec86326c723932c1e79ebf0@group.calendar.google.com/events
This is a second dropper used to launch PLUSDROP in another TOUGHPROGRESS campaign.
rule G_Dropper_TOUGHPROGRESS_XML_1 { meta: author = "GTIG" description = "XML lure file used to launch a PLUSDROP dll." md5 = "dccbb41af2fcf78d56ea3de8f3d1a12c" strings: $str1 = "System.Convert.FromBase64String" $str2 = "VirtualAlloc" $str3 = ".InteropServices.Marshal.Copy" $str4 = ".DllImport" $str5 = "kernel32.dll" $str6 = "powrprof.dll" $str7 = ".Marshal.GetDelegateForFunctionPointer" condition: uint16(0)!= 0x5A4D and all of them and filesize > 500KB and filesize < 5MB }PLUSBED is an additional stage observed in other TOUGHPROGRESS campaigns.
rule G_Dropper_PLUSBED_2 { meta: author = "GTIG" date_created = "2025-04-29" date_modified = "2025-04-29" md5 = "39a46d7f1ef9b9a5e40860cd5f646b9d" rev = 1 strings: $api1 = { BA 54 B8 B9 1A } $api2 = { BA 78 1F 20 7F } $api3 = { BA 62 34 89 5E } $api4 = { BA 65 62 10 4B } $api5 = { C7 44 24 34 6E 74 64 6C 66 C7 44 24 38 6C 00 FF D0 } condition: uint16(0) != 0x5A4D and all of them }