[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6q8K97fT15MQjLepCR4K1Nik-VTjEQ3iDOWpZB4oymw":3},{"article":4,"iocs":53,"watch_terms":82,"solutions":83,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a2d235c6-5fa6-48eb-be1f-fd41e69db59e","New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery","new-project-cav3rn-module-abuses-outlook-calendar-events-for-c2-and-dns-aaaa-rec-d2c597","Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.","Kaspersky GReAT researchers have detailed a new module for Project CAV3RN, a sophisticated cyberespionage framework. This module, AzureCommunication.dll, leverages Outlook calendar events via Microsoft Graph for command and control (C2) communication. As a fallback, it uses DNS AAAA records to retrieve configuration data if Microsoft Graph authentication fails.","Project CAV3RN abuses Outlook calendar events for C2 and DNS AAAA records for config recovery.","https:\u002F\u002Fsecurelist.com\u002Fproject-cav3rn-cyberespionage-framework-using-outlook-and-dns\u002F120757\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F21074741\u002Fcav3rn-outlook-dns-featured-image.jpg","2026-07-21T08:40:47+00:00","2026-07-21T10:00:25.573715+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Project CAV3RN","campaign",{"name":21,"type":22},"Microsoft Graph","product",{"name":24,"type":22},"Outlook",{"name":26,"type":27},"DNS","technology",{"name":29,"type":27},".NET Native AOT","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,61,64,67,70,73,76,79],{"type":55,"value":56,"context":57},"mitre_attack","T1071.004","Application Layer Protocol: DNS",{"type":55,"value":59,"context":60},"T1071.001","Application Layer Protocol: Web Protocols",{"type":55,"value":62,"context":63},"T1105","Ingress Tool Transfer",{"type":55,"value":65,"context":66},"T1041","Exfiltration Over C2 Channel",{"type":55,"value":68,"context":69},"T1095","Non-Application Layer Protocol",{"type":55,"value":71,"context":72},"T1573.002","Symmetric Cryptography",{"type":55,"value":74,"context":75},"T1026","Multi-Stage Channels",{"type":55,"value":77,"context":78},"T1071","Application Layer Protocol",{"type":55,"value":80,"context":81},"T1573","Encrypted Channel",[21],{"controls":84,"vendors":171},[85,114,142],{"slug":86,"name":87,"problem":88,"products":89},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":34,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":143,"name":144,"problem":145,"products":146},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[147,155,163],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[],{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":189},"project-cav3rn-hijacks-outlook-calendar-dns-for-stealthy-c2-communication","Project CAV3RN Hijacks Outlook Calendar & DNS for Stealthy C2 Communication","The AzureCommunication.dll module demonstrates how attackers increasingly abuse legitimate cloud services — in this case, Microsoft Graph API and Outlook calendar events — to blend malicious C2 traffic with trusted, allowed business communication. By disguising command channels within everyday productivity tools, the malware evades traditional network-based detection that typically flags known-bad domains or IP addresses. The fallback use of DNS AAAA records for configuration recovery further illustrates the attacker's resilience planning, ensuring the implant can self-recover even when primary channels are disrupted. This matters because perimeter defenses and blocklists are ineffective against threats that ride on whitelisted, encrypted SaaS traffic, demanding behavioral and anomaly-based detection strategies instead.",[177,178,179,180,181,182,183,184,185,186,187,188],"MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols","MITRE ATT&CK T1568.002 – Dynamic Resolution: Domain Generation Algorithms","MITRE ATT&CK T1550.001 – Use Alternate Authentication Material: Application Access Token","CIS Control 13 – Network Monitoring and Defense","CIS Control 6 – Access Control Management","CIS Control 4 – Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 SC-7 – Boundary Protection","NIST CSF DE.AE-1 – Anomalies and Events Baseline","NIST CSF PR.AC-3 – Remote Access Management","GDPR Article 32 – Security of Processing (for organizations handling EU data)",{}]