Related Threat Clusters

CAV3RN Framework Upgrades to Outlook Calendar for C2 Communication
The Project CAV3RN cyberespionage framework has evolved with the introduction of a new communication module, AzureCommunication.dll, which replaces the previous HTTP/WebSocket component. This module utilizes Outlook…

2 articles · Updated July 21, 2026
Project CAV3RN Enhances Espionage Tactics Using Google Apps Script and DNS
Project CAV3RN is a modular cyberespionage framework targeting organizations in Israel. Recent developments reveal its use of a sophisticated command-and-control (C2) design that dynamically combines direct HTTPS…

3 articles · Updated August 12, 2026

Recent Intelligence Reports

Project CAV3RN Uses Google Apps Script and DNS to Hide C2 Traffic in Israeli Cyberespionage Attacks — Gbhackers · August 12, 2026
Project CAV3RN continues: Google Apps Script as C2 relay and DNS — Securelist · August 11, 2026
New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops — Gbhackers · July 21, 2026
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery — Securelist · July 21, 2026

Malware Azure Outlook Israel T1071.004 - DNS T1071 - Application Layer Protocol Google Apps Script Microsoft 365 Microsoft Graph Microsoft .NET 8 NativeAOT Microsoft Outlook Windows