In a report published this week, analysts at Google have uncovered a campaign in which a China-linked group known as APT41 targeted government ministries and other organisations.

Victims received spearphishing emails directing them to a ZIP file hosted on a compromised official website. Inside, a PDF and some insect images were designed to tempt users into clicking.

Opening the PDF quietly installed a programme called ToughProgress, which runs entirely in a device's memory to evade antivirus checks. Once active, the malware stole sensitive files and prepared them for exfiltration.

Google Calendar became the hackers' secret communication channel. An event dated 30 May 2023 carried encrypted data stolen from victims in its description.

Further entries in July contained new instructions. ToughProgress regularly checked the attacker-controlled calendar, decrypted any commands and uploaded its results back as new calendar events.

APT41 is one of China's most active state-linked cyber groups. US authorities charged five members in 2020 with over a hundred intrusions worldwide and issued arrest warrants for operatives including Zhang Haoran and Tan Dailin.

Earlier investigations tie the group to long-running breaches of Southeast Asian government agencies and a Taiwanese research institute working on strategic technology.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!