Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Cybersecurity researchers have traced the evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Kaspersky discovered a complex C2 module that uses DNS A-record responses to cho…
Intelligence analysis by Llama
Cavern C2 uses DNS and Google Apps Script to blend into legitimate traffic, making it harder to detect. The framework has evolved to use a modular, extensible architecture with a plugin-based system.
Imagine a group of hackers using a special tool to hide their online activities. They use a legitimate service like Google Apps Script to send and receive messages, making it hard for security experts to detect their actions. This tool is called Cavern C2, and it's used by Iranian nation-state hackers to target entities in Israel.
Analysis
Cavern C2 Framework Overview
Cavern C2 is a command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. The framework has been publicly documented by Check Point Research in early July 2026. It consists of multiple moving parts, including an Agent and an assortment of modules, that work in tandem to enable mission-specific post-exploitation functionality, while minimizing forensic visibility and ensuring persistent access.
New Communication Module
Kaspersky discovered a new communication module, GoogleService.dll, which reads a configuration file from disk ("conf.json") and performs a DNS A-record query to opt for either a direct HTTPS or a Google Apps Script relay for each transaction. When the Google mode is selected, the module sends requests to the Apps Script deployment, which then forwards them to the threat actor-controlled backend. If Direct HTTPS is chosen by DNS, it contacts the configured address without using the relay.
Inter-Component Broker
The cybersecurity vendor also discovered an inter-component broker ("rnp.dll") that functions as the framework's local bridge, which discovers and loads DLL components, routes messages between them, and supports runtime upgrades. Although the primary domain linked to the activity ("studiotikva[.]com") was first registered in February 2024, the domain is said to have expired in February 2026, only for it to be re-registered three months later.
Ongoing Evolution of Cavern Framework
The development is a sign of ongoing evolution of the Cavern framework, while relying on legitimate services to evade conventional perimeter defenses. "By abusing legitimate services — previously Outlook calendar events and now Google Apps Script — the framework blends its C2 traffic with normal network activity, complicating network-based detection," Kaspersky said. "Given its development pace, modular design, and operational tempo, we assess that CAV3RN will likely continue to expand."
Key points
- Cavern C2 is a command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel.
- The framework has evolved to use a modular, extensible architecture with a plugin-based system.
- Kaspersky discovered a new communication module, GoogleService.dll, which uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction.
- The framework uses an inter-component broker ("rnp.dll") to discover and load DLL components, route messages between them, and support runtime upgrades.
- The Cavern C2 framework's ability to blend into legitimate traffic makes it a significant threat to cybersecurity.
If the Cavern C2 framework is detected and countered, it could lead to a decrease in the number of successful attacks by Iranian nation-state hackers. This could also lead to a shift in the hackers' tactics, making them more detectable and easier to counter.
If the Cavern C2 framework continues to evolve and improve, it could lead to a significant increase in the number of successful attacks by Iranian nation-state hackers. This could also lead to a decrease in the effectiveness of current security measures, making it harder to detect and counter the hackers' actions.
