Project CAV3RN Uses Google Apps Script and DNS to Hide C2 Traffic in Israeli Cyberespionage Attacks

Gbhackers •Mayura Kathir • August 12, 2026

Project CAV3RN, a modular cyberespionage framework targeting organizations in Israel, has added a sophisticated command-and-control design that dynamically blends direct HTTPS traffic with Google Apps Script relays. The latest findings show an operator prioritizing resilience, modularity and network camouflage rather than reliance on a single C2 channel. Earlier reporting documented its use of Microsoft Outlook […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Project CAV3RN Enhances Espionage Tactics Using Google Apps Script and DNS Project CAV3RN is a modular cyberespionage framework targeting organizations in Israel. Recent developments reveal its use of a sophisticated command-and-control (C2) design that dynamically combines direct HTTPS traffic with Google Apps Script relays. This approach enhances resilience and network camouflage, allowing operators to avoid detection. The framework's architecture includes a local broker that manages DLL components and facilitates runtime upgrades. Key components like GoogleService.dll have been identified, which utilize DNS A-record responses to determine the communication method for each transaction. The framework's ongoing evolution indicates a significant threat to Israeli organizations, with potential implications for broader cybersecurity. The attack method leverages existing cloud services to obscure malicious activities. 3 sources 73

Extracted Entities

Project CAV3RN Uses Google Apps Script and DNS to Hide C2 Traffic in Israeli Cyberespionage Attacks

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)