"The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction," Kaspersky said in an analysis.
How Cavern now blends with Google Apps Script and DNS
Kaspersky’s latest analysis traces a new Cavern (aka CAV3RN) communication module that deliberately blends malicious traffic with commonplace services. The component, GoogleService.dll, reads a local configuration file ("conf.json") and performs a DNS A-record query that determines, per transaction, whether the implant will use a direct HTTPS channel or route requests through a Google Apps Script relay. When the DNS answer selects Google mode, requests are sent to the Apps Script deployment, which then forwards them to a threat actor-controlled backend; when DNS chooses Direct HTTPS, the module contacts the configured address without using the relay.
Local bridging, relay rotation and resilience
Kaspersky also identified an inter-component broker called rnp.dll that acts as the framework’s local bridge: it discovers and loads DLL components, routes messages between them, and supports runtime upgrades. The vendor found that the same DNS infrastructure can validate and replace the relay deployment ID, "allowing the operator to rotate the Google channel." Together these behaviors show an operational pattern: DNS controls which outward channel is used and can update the Apps Script deployment identifier to change relays without altering the implant itself.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildModular evolution and previously seen techniques
Cavern’s modular, plugin-based architecture—assessed by Kaspersky to have shifted to a more extensible design in late April 2026—ties the new findings to a broader toolkit. The framework includes an Agent and modules that facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling. Kaspersky linked Cavern’s use to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS), and noted overlaps with MuddyWater and an OilRig sub-group known as Lyceum.
Kaspersky additionally flagged low-confidence indicators connecting Cavern to OilRig (aka APT34) such as use of Microsoft-hosted services for C2, presence of a secondary recovery mechanism for replacement OAuth refresh tokens, and use of compromised infrastructure belonging to entities in regions it targets. The primary domain tied to the activity, "studiotikva[.]com," was first registered in February 2024, expired in February 2026, and was re-registered three months later—an infrastructure timeline Kaspersky highlighted as part of ongoing evolution.
HOLLOWGRAPH: calendars and DNS tunneling
Separate but related reporting by Group-IB and Kaspersky described HOLLOWGRAPH, a Cavern module that weaponizes Microsoft 365 calendars as covert two-way C2 channels. Group-IB summarized the technique: "Using the Microsoft Graph API, it treats the compromised mailbox's calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached." To avoid alerting mailbox owners, the operators date every event far into the future—13 May 2050—attaching payloads as files to the event.
HOLLOWGRAPH combines that calendar abuse with DNS tunneling to refresh Microsoft Entra ID (Azure AD) credentials used for Graph API access, writing updated values to a text file on disk. The module was delivered as a .NET NativeAOT-compiled DLL and was first seen in the wild on June 7, 2026, according to the reporting.
APT42 resurfaces with TAMECAT and AI-enabled targeting
Concurrently, DarkAtlas documented APT42’s spear-phishing campaigns that used LNK files disguised as PDF documents to target individuals associated with the nuclear energy sector during April and May 2026. The social-engineering themes deployed podcast and interview invitations. The attack chain culminated in TAMECAT, a modular surveillance and collection framework that supports enumeration, arbitrary command execution, browser credential and cookie collection, Outlook .ost mailbox collection, screenshot capture, and fallback C2 and exfiltration mechanisms. DarkAtlas also reported that the group has used generative artificial intelligence to speed operations—helping develop tooling, research exploits, translate languages, and find official email addresses.
What this means for technologists, entities in Israel, and the nuclear energy sector
- Technologists and security teams: Track anomalies where DNS A-record responses appear to select communication channels, inventory Apps Script deployments that could act as relays, and watch for local components (for example, GoogleService.dll, rnp.dll) loading configuration from conf.json files.
- Entities in Israel: Kaspersky’s reporting links Cavern activity to operations targeting entities in Israel; these organizations should note the shift to tactic-and-channel rotation that leverages both Microsoft and Google-hosted services.
- The nuclear energy sector: DarkAtlas’ account of APT42 targeting this sector via LNK-based lures in April–May 2026 underscores that sector-specific social engineering remains a vector; defenders should be aware that threat actors are pairing tailored lures with robust modular implants such as TAMECAT.
Kaspersky summed up the trajectory plainly: "By abusing legitimate services — previously Outlook calendar events and now Google Apps Script — the framework blends its C2 traffic with normal network activity, complicating network-based detection." Given the documented pace of development, modularity, and operational tempo, Kaspersky concluded that CAV3RN "will likely continue to expand."
