Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Summary: Kaspersky researchers found that the Iranian nation-state Cavern (Cav3rn) C2 framework uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction, with the same DNS infrastructure able to validate and replace the relay deployment ID so operators can rotate the Google channel. A related module called HOLLOWGRAPH, first detected in the wild on June 7, 2026, abuses the Microsoft Graph API to plant tasking as Microsoft 365 calendar events dated 13 May 2050 and exfiltrate files as encrypted attachments, using DNS tunneling to refresh Microsoft Entra ID credentials.
Key Takeaway: The framework hides its command traffic inside Google Apps Script and Outlook calendar events, so perimeter defenses see ordinary service traffic rather than a C2 channel. Kaspersky assesses that Cav3rn, tied to Iran's Ministry of Intelligence and Security, will likely keep expanding given its development pace and modular design.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026