Iranian Cavern C2 Hides in DNS and Google Apps Script Traffic

Cybersecurity researchers at Kaspersky have documented the continued evolution of the Cavern (aka Cav3rn) command-and-control framework, which is being actively deployed by Iranian nation-state hackers against targets in Israel. Since December 2025, ongoing monitoring of the threat cluster has uncovered previously unreported components that significantly expand the toolkit's communication capabilities. The centerpiece is a sophisticated C2 module that leverages DNS A-record responses to dynamically choose between direct HTTPS and a Google Apps Script relay for each transaction, while the same DNS infrastructure validates and replaces the relay deployment ID to enable seamless rotation of the Google channel.

Cavern, first publicly documented by Check Point Research in early July 2026, is a modular framework consisting of an Agent and a collection of supporting modules that together enable mission-specific post-exploitation functions while minimizing forensic visibility. Its modules support file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling. The framework's use has been attributed to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) that overlaps with MuddyWater and an OilRig sub-group known as Lyceum.

Follow-up reports from Group-IB and Kaspersky also detailed a related module called HOLLOWGRAPH, a .NET NativeAOT-compiled DLL first observed in the wild on June 7, 2026, that abuses the Microsoft Graph API to turn Microsoft 365 calendars into a covert two-way C2 channel. Operators plant tasking as calendar events, while the implant exfiltrates stolen files by creating its own events with encrypted payloads attached — dated far into the future (e.g., May 13, 2050) to avoid detection. DNS tunneling is simultaneously used to refresh the Microsoft Entra ID (Azure AD) credentials needed to authenticate to the Graph API. Organizations concerned about DNS-based exfiltration paths should run a DNS leak test to verify their resolver integrity, and security teams should audit Google Apps Script deployments in their Google Workspace tenants for unauthorized relay endpoints.

Kaspersky assesses that Cavern's shift to a modular, plugin-based architecture occurred in late April 2026 and has linked the framework to OilRig (aka APT34) with low confidence, citing indicators such as the use of Microsoft-hosted services for C2 (e.g., RDAT and OilCheck) despite no direct code reuse or infrastructure overlap. Defenders are advised to monitor for anomalous DNS A-record patterns, unexpected Google Apps Script relay activity, and suspicious calendar event creation on Microsoft 365 mailboxes. For broader exposure assessment, teams can run a privacy checkup across their cloud estate to identify misconfigured trust relationships that APT groups like Cavern Manticore routinely exploit.