New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

The AzureCommunication.dll module demonstrates how attackers increasingly abuse legitimate cloud services — in this case, Microsoft Graph API and Outlook calendar events — to blend malicious C2 traffic with trusted, allowed business communication. By disguising command channels within everyday productivity tools, the malware evades traditional network-based detection that typically flags known-bad domains or IP addresses. The fallback use of DNS AAAA records for configuration recovery further illustrates the attacker's resilience planning, ensuring the implant can self-recover even when primary channels are disrupted. This matters because perimeter defenses and blocklists are ineffective against threats that ride on whitelisted, encrypted SaaS traffic, demanding behavioral and anomaly-based detection strategies instead.