"The domain is delegated to four actor-controlled authoritative nameservers, ns1 through ns4.cloudlanecdn[.]com," Kaspersky Threat Intelligence reports — a short sentence that captures how a new CAV3RN communication module hides its command-and-control under two unexpected layers: Outlook calendar events and DNS AAAA records.
AzureCommunication.dll: a .NET Native AOT module that speaks Outlook
Kaspersky’s analysis identifies the new communication component as AzureCommunication.dll, a DLL compiled with .NET Native AOT that exposes a single export, QueryInterface. The controller passes QueryInterface a null-terminated UTF‑16 string in one of two forms — get_;;__,_ or send_;;__,__,_ — where the _;;_ and _,_ delimiters separate operation and arguments. The module uses only the seven-character Agent ID from the controller argument; the legacy URL is ignored.
The DLL contains a complete default configuration written to a relative file named logAzure.txt when none exists. That configuration (redacted in the public report) includes a Microsoft Entra TenantId, ClientId, ClientSecret, a compromised Microsoft 365 mailbox UserEmail, a DNS bootstrap Host set to cloudlanecdn[.]com, and RSA public/private keys. The module builds a Microsoft Graph client, acquires an OAuth application token by POSTing to https://login.microsoftonline.com/<TenantId>/oauth2/v2.0/token, and validates access with GET https://graph.microsoft.com/v1.0/organization. If validation succeeds, the module proceeds to use the mailbox calendar as a dead-drop C2 channel.
Outlook calendar events as the covert channel
All communications — commands, heartbeats, and results — are confined to the fixed one‑hour window 2050-05-13 22:00–23:00 UTC so they are unlikely to appear in ordinary calendar views. Event subjects encode purpose and Agent ID: "Event ID: <agent-id>" for operator-to-agent commands, "Boss update ID: <agent-id>1500" for heartbeats, and "Boss Report ID: <agent-id>1500" for agent-to-operator outputs. Heartbeat and result subjects append the literal suffix 1500, which is not part of the Agent ID.
When retrieving a command (get), the module issues a calendarView query filtered with contains(subject,'Event ID: <agent-id>') for the 2050 window, fetches attachments from the returned event, then deletes that calendar event. Attachments are named with a consistent capitalization difference: inbound commands arrive as file0.txt while outbound result attachments are File0.txt, File1.txt, etc.
Inbound command payloads use layered cryptography: the first 256 bytes are an RSA‑OAEP‑SHA256 block containing the 32‑byte AES key; following 12 bytes are the AES‑GCM nonce and the final 16 bytes the authentication tag. After RSA‑OAEP and AES‑256‑GCM decryption, the module obtains JSON such as {"cid":"alXBCzcDl8hBuNE","type":"self","cmd":"003_;;__,_"} where the cid correlates the command and type "self" directs the controller to handle the command internally.
To return output (send), the module encrypts with a fresh AES‑256‑GCM key, protects that key with the hardcoded RSA public key, splits the result into up to 10 MiB chunks, creates a temporary event subject "d", adds sequential attachments, then patches the event subject to "Boss Report ID: <agent-id>1500". Decrypting results requires the attacker-held private key.
DNS AAAA: a byte-packed fallback for configuration recovery
If OAuth token acquisition or the organization validation fails, the module falls back to a DNS-based recovery protocol that treats AAAA responses as 16‑byte containers for data. The module uses cloudlanecdn[.]com, which passive DNS shows was registered on December 24, 2025 and delegated to in‑bailiwick nameservers ns1–ns4.cloudlanecdn[.]com beginning May 2, 2026. Those nameserver hostnames resolve to two shared IPs: 216.126.237[.]197 and 144.172.108[.]205 (ASN 14956, RouterHosting LLC), indicating logical rather than geographically dispersed redundancy.
The module requests four fields in fixed order (Index 0 TenantId, 1 ClientId, 2 ClientSecret, 3 UserEmail). For each field it first queries d.<hex-agent-id>.<field-index>.p.cloudlanecdn[.]com to obtain the length: the response’s first two bytes are discarded and the next two bytes are read as a big‑endian length. It then issues iterative d.<hex-agent-id>.<field-index>.<offset>.q.cloudlanecdn[.]com queries; each normal AAAA response yields up to 14 bytes (after discarding the first two) that the module copies into the buffer until the declared length is reached.
The module treats the AAAA address 2001:4998:44:3507::8000 as a sentinel failure value; when returned, it aborts interpretation of that response. Kaspersky reproduced the protocol in a lab to demonstrate recovering example values (for instance, a 36‑byte TenantId), and the module writes recovered values back to logAzure.txt before retrying Graph validation.
Infrastructure timeline, indicators, and attribution hint
Passive DNS shows cloudlanecdn[.]com’s move from vendor nameservers to in‑bailiwick nameservers on May 2, 2026; the new module carries a May 19 timestamp. Kaspersky assesses with moderate confidence the infrastructure and module were prepared in the same development cycle. File hashes surfaced in the publication include CAF021DDA726B8BA049C2AA395E505A1 and 29B2B8C5D99F05BFCDD0D8D976EB5678 for AzureCommunication.dll and C092B02FBC0FDF7EE9608DD016673806 for NewProject.dll. Domains and IPs called out include cloudlanecdn[.]com; ns1–ns4.cloudlanecdn[.]com; google.com[.]ayalon-print.co[.]il; clipeditskill[.]com; accesslinkssl[.]com; 216[.]126[.]237[.]197; and 144[.]172[.]108[.]205.
Kaspersky retains a low‑confidence assessment that Project CAV3RN is associated with OilRig (APT34), noting behavioral similarities such as Microsoft‑hosted service C2 and secondary recovery mechanisms, but reporting no direct code reuse or infrastructure overlap.
What this means for technologists, defenders, and affected enterprises
- Technologists and security teams: watch for calendar events scheduled for 2050-05-13 22:00–23:00 UTC with subjects beginning "Event ID:", "Boss update ID:", or "Boss Report ID:"; monitor unusual Microsoft Graph app activity and safeguard application credentials that could be embedded in binaries.
- Defenders and incident responders: consider the presence of a logAzure.txt in application working directories, and look for DNS activity resolving cloudlanecdn[.]com and its in‑bailiwick nameservers, including AAAA responses that encode nonstandard payloads.
- Affected enterprises (notably those with regional Microsoft 365 mailboxes): note that the module uses a compromised mailbox as the calendar storage; mailbox compromise and exposed application secrets are central to this transport.
The module’s design — a calendar-based dead‑drop combined with a byte-packed DNS fallback and active development between December 2025 and May 2026 — shows an operator engineering multiple, redundant ways to preserve cloud C2 access. Kaspersky says it continues to track the activity.
