Project CAV3RN Expands Espionage with Google Apps Script and DNS Routing

Project CAV3RN is a modular espionage framework employed against targets in Israel. This report builds upon two earlier publications, the first released in June 2026 as part of Kaspersky's Threat Intelligence Reporting service, and the second published on Securelist the following month, which documented the framework’s evolving architecture and command and control (C2) capabilities.

Recent tracking of this cluster in early August 2026 revealed several previously undocumented components that enhance the framework’s communication and orchestration capabilities. A significant finding is a complex C2 module that utilizes DNS A-record responses to select between direct HTTPS and a Google Apps Script relay for each transaction. This DNS infrastructure can also validate and replace the relay deployment ID, enabling the operator to rotate the Google channel.

Additionally, the framework’s local broker has been identified, which discovers and loads DLL components, routes messages between them, and supports runtime upgrades. The communication module, GoogleService.dll, is a 64-bit DLL compiled with Microsoft .NET 8 NativeAOT. It exports several functions, including GroupByCategory and CheckAvailability, and interacts with the local broker to initiate its C2 worker.

C2 packets are structured with type, cid, and payload fields. The communication module processes certain packet types internally while forwarding others to the local broker. The module also reads configuration settings from a conf.json file and generates a client identifier if the file is missing. It performs DNS A-record queries to determine whether to use Direct HTTPS or Google Apps Script for communication.

The framework’s infrastructure has shown to be versatile, allowing for the selection of communication channels based on the current operational state. When using Google mode, the module retrieves its deployment ID through DNS queries, ensuring the freshness of its operational parameters. This method complicates detection efforts by blending C2 traffic with legitimate network activity.

Project CAV3RN continues to evolve, introducing increasingly sophisticated components and communication capabilities. By leveraging legitimate services, such as Google Apps Script, the framework obscures its C2 traffic within normal network activity, making it challenging for network-based detection systems to identify malicious behavior. Given its rapid development and modular design, it is anticipated that CAV3RN will continue to expand its capabilities. Ongoing tracking of the framework will be conducted to monitor its activity in the wild.