Reported by 3 outlets

Timeline

1. original reporting

   CAV3RN Hides Cyberespionage C2 Behind Google Apps Script and Lets DNS Pick the Route

   cyberpress.org · 62d ago · August 12th, 2026

   Project CAV3RN, a modular cyberespionage framework targeting organizations in Israel, has added a new command-and-control (C2) design that hides traffic behind Google Apps Script. The malware uses DNS A-record responses to decide whether each request should travel through a Google relay or directly to an attacker-controlled HTTPS server. The newly identified communication component, GoogleService.dll, is a 64-bit .NET 8 NativeAOT module. It works with a local DLL broker, allowing operators to load, manage, and upgrade framework components while the infected host remains active. This design gives CAV3RN a flexible and resilient architecture. Before it checks for commands or sends results, GoogleService.dll makes a DNS query to a subdomain under studiotikva[.]com . The query includes a random value, the malware’s current error state, and a hexadecimal version of the victim identifier. CAV3RN DNS-Routes Google C2 The DNS response does more than resolve a domain. Its final IP-address octet works as an instruction for the malware. A response ending in 120 can select either the Google Apps Script channel or direct HTTPS, depending on the previous failure state. A response ending in 130 usually selects direct HTTPS, while 140 forces an exception. Other values generally push the malware toward Google Apps Script. CAV3RN DNS control-plane response: the final octet 120 selects the direct HTTPS channel (Source: securelist) This gives operators a lightweight control plane. They can chang

2. update from malware.news

   Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

   malware.news · 63d ago · August 11th, 2026

   Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service , and the second was published on Securelist the following month, further documenting the framework’s evolving architecture and C2 capabilities. Continued tracking of this cluster in early August 2026 uncovered several previously undocumented components that expanded the framework’s communication and orchestration capabilities. The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel. We also identified the framework’s local broker, which discovers and loads DLL components, routes messages between them, and supports runtime upgrades. Multi-transport C2 communication module The communication module, GoogleService.dll , is a 64-bit DLL compiled with Microsoft .NET 8 NativeAOT. Its PDB path is: C:\Users\user\Desktop\Modules\broker-cavern\communication\Goog

3. update from gbhackers.com

   Project CAV3RN Uses Google Apps Script and DNS to Hide C2 Traffic in Israeli Cyberespionage Attacks

   gbhackers.com · 62d ago · August 12th, 2026

   The latest findings show an operator prioritizing resilience, modularity and network camouflage rather than reliance on a single C2 channel. Earlier reporting documented its use of Microsoft Outlook […] The post Project CAV3RN Uses Google Apps Script and DNS to Hide C2 Traffic in Israeli Cyberespionage Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .