Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Summary

Iranian nation-state hackers have updated their Cavern command-and-control framework with new modules that leverage DNS and Google Apps Script to blend into legitimate traffic. The malware, linked to the MOIS and sharing overlaps with MuddyWater and Lyceum, uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay. Additionally, a separate module called HOLLOWGRAPH abuses Microsoft 365 calendars and the Graph API for covert C2 communication and data exfiltration.

Full text

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic Ravie LakshmananAug 17, 2026Cyber Espionage / Artificial Intelligence Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the toolkit's communication capabilities. "The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction," Kaspersky said in an analysis. "The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel." Cavern, first publicly documented by Check Point Research in early July 2026, consists of multiple moving parts, including an Agent and an assortment of modules, that work in tandem to enable mission-specific post-exploitation functionality, while minimizing forensic visibility and ensuring persistent access. The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling. The use of Cavern C2 has been linked to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) that shares overlaps with MuddyWater and an OilRig sub-group known as Lyceum. Two back-to-back follow-up reports from Group-IB and Kaspersky detailed another module dubbed HOLLOWGRAPH that turns Microsoft 365 calendars into covert C2 channels. The malware, in particular, abuses the Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication. "Using the Microsoft Graph API, it treats the compromised mailbox's calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached," Group-IB noted. "To avoid catching the mailbox owner's attention, every event is dated far into the future — 13 May 2050 — with payloads attached as files to the event." In tandem, the malware employs DNS tunneling as a way to refresh the Microsoft Entra ID (Azure AD) credentials used to authenticate to the Graph API and write the updated values to a text file on disk. A .NET NativeAOT-compiled DLL, HOLLOWGRAPH, was first detected in the wild on June 7, 2026. Cavern's shift to a modular, extensible architecture using a plugin-based system is assessed to have taken place in late April 2026, per Kaspersky, which has since linked it to OilRig (aka APT34) with low confidence, citing the following indicators despite no direct code reuse or infrastructure overlap - Use of Microsoft-hosted services for C2 (e.g., RDAT, OilCheck) Presence of secondary recovery mechanism to obtain replacement OAuth refresh tokens, as observed in OilBooster Use of compromised infrastructure belonging to entities in regions it targets, as observed in Solar and Veaty malware The latest findings from Kaspersky are a new communication module, GoogleService.dll, which reads a configuration file from disk ("conf.json") and performs a DNS A-record query to opt for either a direct HTTPS or a Google Apps Script relay for each transaction. When the Google mode is selected, the module sends requests to the Apps Script deployment, which then forwards them to the threat actor-controlled backend. If Direct HTTPS is chosen by DNS, it contacts the configured address without using the relay. The cybersecurity vendor said it also discovered an inter-component broker ("rnp.dll") that functions as the framework's local bridge, which discovers and loads DLL components, routes messages between them, and supports runtime upgrades. Although the primary domain linked to the activity ("studiotikva[.]com") was first registered in February 2024, the domain is said to have expired in February 2026, only for it to be re-registered three months later. The development is a sign of ongoing evolution of the Cavern framework, while relying on legitimate services to evade conventional perimeter defenses. "By abusing legitimate services — previously Outlook calendar events and now Google Apps Script — the framework blends its C2 traffic with normal network activity, complicating network-based detection," Kaspersky said. "Given its development pace, modular design, and operational tempo, we assess that CAV3RN will likely continue to expand." APT42 Resurfaces with TAMECAT The disclosure comes as DarkAtlas detailed APT42's use of TAMECAT in spear-phishing attacks targeting individuals associated with the nuclear energy sector as recently as April and May 2026 via LNK files masquerading as PDF documents. "The social-engineering theme used podcast and interview invitations, continuing the group's preference for credible professional engagement before malware delivery," DarkAtlas said. The attack chain culminates in the deployment of TAMECAT, a modular surveillance and collection framework that supports enumeration, discovery, arbitrary command execution, browser credential and cookie collection, Outlook .ost mailbox collection, screenshot capture, and fallback C2 and exfiltration mechanisms. The Iranian hacking group has also been observed using generative artificial intelligence (AI) as a way to accelerate operations, including developing specialized tooling, researching exploitation techniques, language translation, and identifying official email addresses, and investigating entities of interest. "APT42 remains an intelligence-collection threat whose advantage comes from patient human targeting, now accelerated by AI and supported by more resilient malware when needed," DarkAtlas said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  artificial intelligence, Cloud security, Command and Control, cyber espionage, Malware, Microsoft, Nation-State, network security, Phishing, Threat Intelligence ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Co

Indicators of Compromise

• malware — Cavern
• malware — Cav3rn
• malware — HOLLOWGRAPH
• malware — GoogleService.dll
• malware — rnp.dll
• mitre_attack — T1071.004
• mitre_attack — T1102
• mitre_attack — T1041
• mitre_attack — T1573.002

Entities