Project CAV3RN's Evolving Tactics: Leveraging Google Apps Script and DNS for Stealthy C2
In August 2026, Kaspersky researchers identified an evolution in the Project CAV3RN cyberespionage framework, which has been targeting Israeli organizations since December 2025. The latest development involves a sophisticated command-and-control (C2) module that utilizes Google Apps Script as a relay and employs DNS-based mechanisms for C2 channel selection. This approach allows the malware to blend its communication with legitimate network traffic, thereby evading traditional detection methods. The framework's modular design and rapid development indicate a persistent and adaptable threat. The significance of this incident lies in the increasing trend of threat actors leveraging legitimate cloud services to obfuscate malicious activities. By integrating Google Apps Script and DNS-based techniques, Project CAV3RN exemplifies the challenges in distinguishing between normal and malicious network behavior, underscoring the need for advanced detection strategies.
Kill Chain
