Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.
Kaspersky reported new components in the Cavern (Cav3rn) C2 framework, used by Iranian MOIS-affiliated Cavern Manticore (with overlaps to MuddyWater and OilRig's Lyceum) against Israeli entities, monitored since December 2025. The new GoogleService.dll module performs DNS A-record queries to choose between direct HTTPS and a Google Apps Script relay per transaction, with the DNS infrastructure able to rotate the Google deployment ID; Kaspersky also found an inter-component broker (rnp.dll) and linked the framework's plugin-based pivot to late April 2026. Separately, Group-IB and Kaspersky detailed HOLLOWGRAPH, a .NET NativeAOT DLL first seen in the wild June 7, 2026, that uses Microsoft 365 calendar events via the Graph API as two-way dead drops dated May 13, 2050, with DNS tunneling refreshing Entra ID credentials. DarkAtlas also reported APT42's TAMECAT modular surveillance framework delivered via LNK masquerading as PDFs in spear-phishing targeting the nuclear energy sector in April-May 2026, with the group using generative AI to accelerate operations.
- GoogleService.dll uses DNS A-record responses to switch between direct HTTPS and Google Apps Script relay.
- HOLLOWGRAPH abuses Microsoft 365 calendars via Graph API as two-way dead drops dated May 13, 2050.
- DNS tunneling refreshes Entra ID credentials used for Graph API authentication.
- Cavern shifted to a modular, plugin-based architecture in late April 2026.
- APT42's TAMECAT targeted the nuclear energy sector via LNK files and podcast invitation lures.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1071.004 DNST1041 Exfiltration Over C2 ChannelT1090.001 Internal Proxy
- Products
- Microsoft 365Microsoft Graph API
- Threat actors
- Cavern ManticoreAPT42OilRigMuddyWater
- Malware
- CavernHOLLOWGRAPHTAMECAT
- Organizations
- Check Point Research
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.