Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

The Cavern C2 framework demonstrates how sophisticated nation-state actors exploit trusted cloud services — Google Apps Script, Microsoft 365 Graph API, and standard DNS — to camouflage malicious command-and-control traffic within legitimate-looking network activity. Because these platforms are widely trusted and often allowed through enterprise firewalls, traditional perimeter defenses fail to detect the covert channel. The HOLLOWGRAPH module's abuse of Microsoft 365 calendars for data exfiltration is particularly dangerous because it exploits authenticated, encrypted SaaS traffic that many organizations do not deeply inspect. This matters because defenders who rely solely on blocklists or signature-based detection will miss these channels entirely, giving attackers persistent, stealthy access.