CAV3RN Framework Upgrades to Outlook Calendar for C2 Communication

The Project CAV3RN cyberespionage framework has evolved with the introduction of a new communication module, AzureCommunication.dll, which replaces the previous HTTP/WebSocket component. This module utilizes Outlook calendar events accessed via Microsoft Graph for command and control (C2) communication, enhancing its stealth capabilities. Additionally, it employs DNS AAAA records for configuration recovery. The framework has been active against targets in Israel since December 2025, with significant changes noted in April 2026. This shift to a controller-based architecture allows for more modular post-exploitation capabilities. The new communication method aims to avoid detection while maintaining operational effectiveness. The full implications of this upgrade are still being analyzed, and further public research is expected to emerge.

Key Points: • CAV3RN's new module uses Outlook calendar events for stealthy C2 communication. • The framework targets entities in Israel and has been active since late 2025. • The upgrade enhances modular capabilities and avoids detection by traditional methods.