Every signal defenders usually rely on to judge a link returned a reassuring answer, and the operator built the chain that way on purpose. Material Security's Threat Research team identified the campaign and has taken down hundreds of domains used by attackers in what they have dubbed Operation CloudFire.
Here's what they learned along the way. The messages arrive as Google Calendar invites, sometimes delivered by BCC and often sent from an organization the recipient has already corresponded with.
The pretexts are mundane: voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices. Most links point to Google itself. The typical pattern is Google's own /url redirector with the real destination in a query parameter, though other waves used share.google and Drive file links for the same purpose.
