[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcC71xeaGJLHc97Ut9TaSjor4bHrTYsi05EGe3DNW6NQ":3},{"article":4,"iocs":54,"watch_terms":83,"solutions":84,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"70448a7b-cfc1-420c-8bf3-c18fbd7e6bdc","Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic","cavern-c2-uses-dns-and-google-apps-script-to-blend-into-legitimate-traffic-788b4d","Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the","Iranian nation-state hackers have updated their Cavern command-and-control framework with new modules that leverage DNS and Google Apps Script to blend into legitimate traffic. The malware, linked to the MOIS and sharing overlaps with MuddyWater and Lyceum, uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay. Additionally, a separate module called HOLLOWGRAPH abuses Microsoft 365 calendars and the Graph API for covert C2 communication and data exfiltration.","Iranian nation-state hackers evolve Cavern C2 with DNS and Google Apps Script.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcavern-c2-uses-dns-and-google-apps.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhu-MyaPNuRr2_NJ_TMqLf7OYW5AzCqgHpQ6HMfxlc-qsMzwSkfWlZDbHfecZ3IRp639FVDelhMZgpbnN87Fdchoh-g08R-cAiXxr7RvfdGy_ihvMxg152HK-rbOTIOnEueRTnPT-wU0eID3vplpIN1GBClvJC5e0egCGpDb_H0ykwH1x6a4zOvpW8V-Ssy\u002Fs1600\u002Fgoogle.jpg","2026-08-17T17:41:06+00:00","2026-08-17T20:00:18.160564+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Cavern Manticore","threat_actor",{"name":21,"type":19},"MuddyWater",{"name":23,"type":19},"Lyceum",{"name":25,"type":19},"OilRig",{"name":27,"type":28},"Kaspersky","vendor",{"name":30,"type":28},"Check Point Research","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,61,64,67,70,74,77,80],{"type":48,"value":56,"context":57},"Cavern","Command-and-control framework used by Iranian nation-state hackers.",{"type":48,"value":59,"context":60},"Cav3rn","Alternative name for the Cavern C2 framework.",{"type":48,"value":62,"context":63},"HOLLOWGRAPH","Module that abuses Microsoft 365 calendars for C2.",{"type":48,"value":65,"context":66},"GoogleService.dll","New communication module for Cavern C2.",{"type":48,"value":68,"context":69},"rnp.dll","Inter-component broker for the Cavern C2 framework.",{"type":71,"value":72,"context":73},"mitre_attack","T1071.004","Application Layer Protocol: DNS used for C2 communication.",{"type":71,"value":75,"context":76},"T1102","Web Service: Cloud Services for C2 communication (Google Apps Script, Microsoft 365).",{"type":71,"value":78,"context":79},"T1041","Exfiltration Over C2 Channel: Using calendar events for data exfiltration.",{"type":71,"value":81,"context":82},"T1573.002","Encrypted Channel: HTTPS for C2 communication.",[27,30],{"controls":85,"vendors":169},[86,115,144],{"slug":87,"name":88,"problem":89,"products":90},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":116,"name":117,"problem":118,"products":119},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":53,"name":145,"problem":146,"products":147},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[148,156,161],{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":157,"product_name":158,"url":159,"description":160},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[170,176],{"slug":171,"name":172,"logo_path":173,"roles":174},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[175],"reported_by",{"slug":100,"name":101,"logo_path":102,"roles":177},[178],"affected",{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":195},"iranian-hackers-abuse-dns-and-cloud-apis-to-hide-c2-traffic","Iranian Hackers Abuse DNS and Cloud APIs to Hide C2 Traffic","The Cavern C2 framework demonstrates how sophisticated nation-state actors exploit trusted cloud services — Google Apps Script, Microsoft 365 Graph API, and standard DNS — to camouflage malicious command-and-control traffic within legitimate-looking network activity. Because these platforms are widely trusted and often allowed through enterprise firewalls, traditional perimeter defenses fail to detect the covert channel. The HOLLOWGRAPH module's abuse of Microsoft 365 calendars for data exfiltration is particularly dangerous because it exploits authenticated, encrypted SaaS traffic that many organizations do not deeply inspect. This matters because defenders who rely solely on blocklists or signature-based detection will miss these channels entirely, giving attackers persistent, stealthy access.",[184,185,186,187,188,189,190,191,192,193,194],"CIS Control 13 – Network Monitoring and Defense","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 SC-7 – Boundary Protection","MITRE ATT&CK T1071.004 – Application Layer Protocol: DNS","MITRE ATT&CK T1102 – Web Service (C2 via cloud services)","MITRE ATT&CK T1048 – Exfiltration Over Alternative Protocol","NIST CSF DE.CM-1 – Network Communications Monitored","GDPR Article 32 – Security of Processing (data exfiltration risk)",{}]