CAV3RN Uses Google Apps Script as C2 Relay to Hide Malware Traffic Behind Google Infrastructure

Cybersecuritynews •Tushar Subhra Dutta • August 12, 2026

CAV3RN is a modular espionage framework that is becoming harder to see on a network. Its newest communication component hides remote-control traffic behind Google Apps Script, a service many organizations use legitimately. That design can make a harmful connection look less unusual at first glance. The framework has been used against targets in Israel and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Project CAV3RN Enhances Espionage Tactics Using Google Apps Script and DNS Project CAV3RN is a modular cyberespionage framework targeting organizations in Israel. Recent developments reveal its use of a sophisticated command-and-control (C2) design that dynamically combines direct HTTPS traffic with Google Apps Script relays. This approach enhances resilience and network camouflage, allowing operators to avoid detection. The framework's architecture includes a local broker that manages DLL components and facilitates runtime upgrades. Key components like GoogleService.dll have been identified, which utilize DNS A-record responses to determine the communication method for each transaction. The framework's ongoing evolution indicates a significant threat to Israeli organizations, with potential implications for broader cybersecurity. The attack method leverages existing cloud services to obscure malicious activities. 3 sources 73

Extracted Entities

CAV3RN Uses Google Apps Script as C2 Relay to Hide Malware Traffic Behind Google Infrastructure

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)