CALENDAR

S0025

About this malware

CALENDAR is malware used by APT1 that mimics legitimate Gmail Calendar traffic.

Technique	Procedure example
T1059.003 Windows Command Shell	CALENDAR has a command to run cmd.exe to execute commands. Mandiant APT1 Appendix
T1102.002 Bidirectional Communication	The CALENDAR malware communicates through the use of events in Google Calendar. Mandiant APT1 Mandiant APT1 Appendix

None recorded.

Mandiant APT1 Open source
Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.