Cavern Hides Among DNS, Google Apps Script, and Microsoft 365 Calendars

An Iranian Framework Expands Its C2 Channels

Kaspersky has documented new components of Cavern, also known as Cav3rn, a modular command-and-control framework linked to Iranian actors targeting organizations in Israel.

The new analysis, published on August 17, 2026, follows monitoring that began in December 2025. Check Point Research disclosed Cavern in early July 2026, describing it as an implant consisting of a central Agent and numerous plugins for post-compromise activities.

The framework is designed to maintain persistence, minimize forensic traces, and adapt its functionality to each operation. Its modules can handle files, SQL databases, Active Directory, networking, and tunneling.

The activity has been attributed to Cavern Manticore, a group believed to be close to Iran’s Ministry of Intelligence and Security. Overlaps have also emerged with MuddyWater and Lyceum, a subgroup of OilRig.

GoogleService.dll Dynamically Selects the Communication Path

The most significant component identified by Kaspersky is GoogleService.dll. The module reads the local conf.json file and queries DNS A records to determine which communication channel to use for each transaction.

There are two options:

• a direct HTTPS connection to the address specified in the configuration;
• routing through a Google Apps Script deployment.

When Google-based mode is selected, the malware sends requests to the script. The script acts as a relay and forwards the traffic to the operator-controlled backend. In direct mode, the component contacts the configured address without an intermediary.

The same DNS infrastructure can provide a new deployment ID for the Google relay. This allows the attacker to replace the Apps Script channel without necessarily distributing a new version of the DLL already installed on the system.

This dynamic selection complicates detection. An organization might block a known domain or address, but subsequent traffic could use HTTPS to a legitimate service routinely used by employees. The domain alone therefore becomes a less reliable indicator.

The architecture also includes rnp.dll, a local broker that locates and loads available DLLs, routes messages between components, and enables modules to be updated while the implant is running.

This structure allows operators to add capabilities, change the C2 route, and deploy functionality without replacing the entire framework.

From System Control to Tunneling Through the Compromised Network

Cavern includes plugins for file operations, SQL database enumeration, and Active Directory reconnaissance. It also supports network discovery, LDAP brute-forcing, and tunneling through SOCKS5 or WebSocket proxies.

The result is an implant suited to multiple stages of an intrusion. After gaining initial access, operators can gather information about the environment, search for accounts and systems of interest, execute commands, and transfer data.

Tunneling also allows the compromised network to serve as a transit point. Attacker traffic can reach other systems or services through internal infrastructure that is already considered trusted.

According to Kaspersky, the shift to an extensible, plugin-based architecture occurred in late April 2026. The company links Cavern to OilRig, also known as APT34, with low confidence.

The assessment is based on operational similarities rather than direct evidence. No code reuse or infrastructure overlap was observed. The factors considered include the use of hosted Microsoft services for C2, mechanisms resembling those in OilBooster for obtaining replacement OAuth refresh tokens, and the use of compromised infrastructure belonging to organizations in the target regions.

The history of the studiotikva[.]com domain also suggests continued development. The domain was first registered in February 2024, expired in February 2026, and was registered again three months later.

HOLLOWGRAPH Turns Microsoft 365 Calendars into a C2 Channel

Another module linked to the activity is HOLLOWGRAPH, which is designed to use the Microsoft Graph API and Microsoft 365 calendars as a command-and-control channel.

The mechanism is bidirectional. Operators place instructions in calendar events within the compromised mailbox. The malware reads the content and interprets it as commands.

For exfiltration, the implant creates new events containing stolen and encrypted data. Files are added as event attachments. The activities are scheduled for May 13, 2050—a distant date intended to reduce the chance that users will immediately recognize the appointments as anomalous.

HOLLOWGRAPH also uses DNS tunneling to update the Microsoft Entra ID credentials—formerly known as Azure AD—required to authenticate to Microsoft Graph. The new values are stored in a text file on disk.

The DLL was compiled with .NET NativeAOT and was first observed in the wild on June 7, 2026. Abuse of Microsoft Graph makes the traffic harder to distinguish from normal cloud activity, particularly in organizations that rely heavily on Outlook and Microsoft 365.

For defenders, visibility cannot be limited to the domains resolved by the malware. They must correlate Graph API access, unusual event creation, encrypted attachments, and authentication originating from hosts that do not normally interact with the affected mailboxes.

APT42 Strikes with Professional Lures and TAMECAT

The same monitoring activity identified a separate campaign attributed to APT42. The group conducted spear-phishing attacks against individuals connected to the nuclear energy sector, with incidents detected in April and May 2026.

The messages used LNK files disguised as PDF documents. The lures referenced podcast invitations and interview requests, a technique consistent with building a credible professional relationship before delivering malware.

The infection chain leads to the installation of TAMECAT, a modular surveillance and collection framework. Its capabilities include discovery, arbitrary command execution, theft of credentials and browser cookies, acquisition of Outlook mailboxes in .ost format, and screenshot capture.

Backup C2 and exfiltration channels are also available. If the primary path fails or is detected, the operator can attempt alternative methods to retain control and transfer data.

APT42 has also been observed using generative artificial intelligence tools. AI was reportedly used to accelerate tool development, research exploitation techniques, translate content, identify official email addresses, and analyze organizations of interest.

What Organizations Should Monitor

Cavern and TAMECAT do not exploit a product vulnerability described by a CVE. As a result, there are no CVSS scores, formal severity classifications, or dedicated patches.

The risk instead involves endpoint compromise and abuse of legitimate services. Consequences may include persistent access, theft of files, credentials, cookies, and mailboxes, directory and network reconnaissance, remote execution, and use of corporate infrastructure for tunneling.

Organizations should watch for unknown DLLs such as GoogleService.dll, rnp.dll, and HOLLOWGRAPH; the conf.json file; text files containing Entra ID credentials; and processes that make anomalous DNS requests before connecting to cloud services.

They should also investigate:

• Google Apps Script deployments that cannot be attributed to corporate users or applications;
• Microsoft 365 events created in large numbers or scheduled for May 13, 2050;
• encrypted attachments added to calendar events;
• unusual access to Microsoft Graph APIs;
• LNK files distributed as purported PDFs;
• SOCKS5 or WebSocket connections originating from workstations;
• DNS requests displaying characteristics consistent with tunneling.

No specific mitigations have been provided by the vendor. Defense must therefore combine EDR, DNS monitoring, control of authorized applications, Microsoft 365 log review, and analysis of anomalous behavior.

Kaspersky considers further expansion of Cavern likely. Its modularity, ability to update during execution, and availability of multiple C2 channels indicate a framework that is still under development and being used operationally.