Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection
Project CAV3RN continues targeting Israel, using Google Apps Script C2 relays and DNS-based channel routing in a .NET NativeAOT framework.
Kaspersky Securelist documents the continuation of Project CAV3RN operations against Israel. The modular .NET NativeAOT framework uses Google Apps Script as a C2 relay and DNS-based C2 channel selection, blending command traffic with legitimate Google services to evade detection.
55