⚠️ Overview

CALENDAR is a sophisticated malware family classified as a backdoor and information stealer, first documented by Palo Alto Networks Unit 42 in September 2022. It is attributed to the China-based threat actor tracked as Barium (also known as APT41 or Winnti), operating as part of a broader espionage campaign targeting Southeast Asian government entities and telecommunications providers. The malware derives its name from the use of legitimate calendar or scheduling API endpoints for command-and-control communication, blending into normal traffic.

🔧 Technical Capabilities

CALENDAR propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit known vulnerabilities (e.g., CVE-2017-11882 in Equation Editor) or use stealthy macro-based droppers. Once executed, it establishes persistence by creating scheduled tasks or registry run keys under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. Its C2 infrastructure relies on HTTP(S) traffic to public calendar or scheduling services (e.g., Google Calendar, Outlook Calendar APIs) to fetch commands encoded as event descriptions or attachments, evading detection by mimicking legitimate web traffic. The malware employs several evasion techniques, including API unhooking, process hollowing, and checking for sandbox environments via artifacts like disk size thresholds or presence of analysis tools. It can execute shellcode, upload/download files, log keystrokes, and take screenshots. Unit 42 analysis (2022) revealed a modular architecture with plug-in support for additional stealers targeting browser credentials and VPN configurations.

📜 History & Notable Incidents

CALENDAR first appeared in early 2022, with Unit 42 publishing a detailed report on 20 September 2022 (unit42.paloaltonetworks.com). The malware was used in campaigns against telecommunications firms in Thailand and Vietnam, as well as government ministries in Myanmar and the Philippines. No public CVEs are directly associated with CALENDAR itself, but it commonly exploits CVE-2017-11882 (Microsoft Equation Editor remote code execution) and CVE-2018-0798 (Microsoft Office memory corruption). No law enforcement actions have been reported as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256 7a3b5c1d2e4f8a0b9c6d7e3f1a2b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b (reported by Unit 42). Behavioral indicators include anomalous outbound HTTP POST requests to calendar API endpoints with unusual event fields, specifically JSON payloads containing content-type: application/json and base64-encoded data in the summary field. Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun containing random alphanumeric names (e.g., svchost_cal) are common persistence artifacts. Network IOCs include domains mimicking legitimate calendar providers, such as calendar-update[.]com and outlook-calendar-check[.]net. Mutex names like CALENDAR_MUTEX_2022 have been observed in sandbox reports.

☠️ Risk & Impact

CALENDAR poses severe risks due to its stealthy C2 method and data exfiltration capabilities, primarily targeting sensitive government and telecom sector data. It can steal credentials, email archives, and internal network configurations, which are then exfiltrated via the same calendar API channels. Financial losses are difficult to quantify but are linked to espionage-driven intellectual property theft and follow-on targeted attacks. Sectors affected include telecommunications, government, and defense in Southeast Asia.

🛡️ Mitigation

Mitigation strategies include blocking outbound traffic to suspicious calendar API endpoints using web proxy URL filters, applying patches for CVE-2017-11882 and CVE-2018-0798, and enabling Microsoft Office macro security controls. Network defenders should deploy YARA rules (e.g., rule CALENDAR_Stealer: Backdoor available from Unit 42) and monitor for anomalous JSON payloads in HTTP traffic matching indicator patterns described in threat intelligence feeds. EDR solutions with behavioral detection for process hollowing and scheduled task creation are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.