Securelist CAV3RN Framework Upgrades to Outlook Calendar for C2 Communication
Article Content
- •CAV3RN's new module uses Outlook calendar events for stealthy C2 communication.
- •The framework targets entities in Israel and has been active since late 2025.
- •The upgrade enhances modular capabilities and avoids detection by traditional methods.
The Project CAV3RN cyberespionage framework has evolved with the introduction of a new communication module, AzureCommunication.dll, which replaces the previous HTTP/WebSocket component. This module utilizes Outlook calendar events accessed via Microsoft Graph for command and control (C2) communication, enhancing its stealth capabilities. Additionally, it employs DNS AAAA records for configuration recovery. The framework has been active against targets in Israel since December 2025, with significant changes noted in April 2026. This shift to a controller-based architecture allows for more modular post-exploitation capabilities. The new communication method aims to avoid detection while maintaining operational effectiveness. The full implications of this upgrade are still being analyzed, and further public research is expected to emerge.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track Cav3rn and Azure in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…