I have no idea when Virus Bulletin uploaded our paper - but here it is: our talk from last September at VB2025, where we talked about an APT41-adjacent group started using Google Calendar C2 as part of their espionage operation.

https://www.virusbulletin.com/uploads/pdf/conference/vb2025/slides/Slides-Google-Calendar-as-C2-Infrastructure-A%20-China-nexus-Campaign-with-Stealthy-Tactics.pdf
https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdf