Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Cavern C2 framework, used by Iranian nation-state hackers (Cavern Manticore/MOIS), has evolved with a new module (GoogleService.dll) that uses DNS A-record queries to dynamically choose between direct HTTPS and Google Apps Script relays for C2 communication HOLLOWGRAPH module abuses Microsoft 365 calendars as covert two-way dead-drop C2 channels via Microsoft Graph API, with calendar events dated to 2050 to avoid detection The framework employs a modular plugin-based architecture with an inter-c
Analysis
TL;DR
- Cavern C2 framework, used by Iranian nation-state hackers (Cavern Manticore/MOIS), has evolved with a new module (GoogleService.dll) that uses DNS A-record queries to dynamically choose between direct HTTPS and Google Apps Script relays for C2 communication
- HOLLOWGRAPH module abuses Microsoft 365 calendars as covert two-way dead-drop C2 channels via Microsoft Graph API, with calendar events dated to 2050 to avoid detection
- The framework employs a modular plugin-based architecture with an inter-component broker (rnp.dll) supporting runtime upgrades and dynamic component loading
- APT42 resurfaces with TAMECAT, a modular surveillance framework using AI-accelerated operations for spear-phishing targeting nuclear energy sector via LNK files disguised as PDFs
- Both threats demonstrate sophisticated abuse of legitimate cloud services (Google Apps Script, Microsoft Graph API) to blend malicious traffic with normal network activity
Why It Matters
This highlights the growing trend of nation-state actors leveraging legitimate SaaS platforms as C2 infrastructure, making traditional perimeter-based detection increasingly ineffective. The integration of generative AI into offensive operations by groups like APT42 represents a significant escalation in operational tempo and capability, requiring defenders to adopt cloud-native detection strategies and enhanced monitoring of legitimate service APIs.
Technical Details
- GoogleService.dll: Reads "conf.json" configuration, performs DNS A-record queries to select between direct HTTPS or Google Apps Script relay for each C2 transaction; same DNS infrastructure can validate and rotate relay deployment IDs
- HOLLOWGRAPH: .NET NativeAOT-compiled DLL (first detected June 7, 2026) that uses Microsoft Graph API to treat compromised calendars as dead-drops; commands planted as calendar events dated May 13, 2050 with encrypted payloads; DNS tunneling refreshes Microsoft Entra ID credentials
- rnp.dll: Inter-component broker functioning as local bridge for DLL discovery, message routing, and runtime upgrades within the Cavern framework
- Cavern modules: File operations, SQL enumeration, Active Directory reconnaissance, LDAP brute-force, network reconnaissance, SOCKS5 proxy, and WebSocket tunneling
- TAMECAT: Modular surveillance framework supporting enumeration, arbitrary command execution, browser credential/cookie collection, Outlook .ost mailbox harvesting, screenshot capture, with fallback C2 and exfiltration mechanisms
Industry Insight
- Organizations should implement enhanced monitoring and anomaly detection for API calls to Microsoft Graph and Google Apps Script, particularly focusing on unusual calendar event patterns and credential refresh behaviors
- The AI-accelerated operational model demonstrated by APT42 suggests defenders must invest in automated threat intelligence analysis and behavioral detection to keep pace with rapidly evolving attack tooling
- Cloud service abuse as C2 infrastructure requires a shift from perimeter-based security to identity-centric and API-traffic monitoring strategies, including baseline behavioral analytics for legitimate SaaS platforms
Disclaimer: The above content is generated by AI and is for reference only.