New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops

Gbhackers •Mayura Kathir • July 21, 2026

In a significant evolution of the Project CAV3RN tooling, a new .NET Native AOT communication module dubbed AzureCommunication.dll has been deployed to replace the framework’s earlier HTTP/WebSocket C2 component. A stealthy channel that abuses Outlook calendar events over Microsoft Graph and a DNS-based recovery mechanism for Microsoft 365 credentials. This shift reinforces CAV3RN’s positioning as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CAV3RN Framework Upgrades to Outlook Calendar for C2 Communication The Project CAV3RN cyberespionage framework has evolved with the introduction of a new communication module, AzureCommunication.dll, which replaces the previous HTTP/WebSocket component. This module utilizes Outlook calendar events accessed via Microsoft Graph for command and control (C2) communication, enhancing its stealth capabilities. Additionally, it employs DNS AAAA records for configuration recovery. The framework has been active against targets in Israel since December 2025, with significant changes noted in April 2026. This shift to a controller-based architecture allows for more modular post-exploitation capabilities. The new communication method aims to avoid detection while maintaining operational effectiveness. The full implications of this upgrade are still being analyzed, and further public research is expected to emerge. 2 sources 76

Extracted Entities

New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)