Harish Kumar 
Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered a new evolution in Project CAV3RN, a modular espionage framework targeting entities in Israel.
The latest findings, published August 11, 2026, reveal that the threat actor behind this campaign has weaponized Google Apps Script as a covert command-and-control (C2) relay, abandoning its earlier reliance on Outlook calendar events in favor of a technique that blends malicious traffic almost seamlessly with legitimate cloud service activity.
At the heart of this update is a newly documented DLL, GoogleService.dll, compiled with Microsoft .NET 8 NativeAOT. Before every C2 transaction, the module fires off a DNS A-record query structured as a random nonce plus an error-state code, appended to a hex-encoded client ID under the domain m.studiotikva.com.
Project CAV3RN Hijacks Google Apps Script for Stealthy
The fourth octet of the returned IP address effectively acts as a routing instruction, telling the malware whether to use direct HTTPS, fall back to the Google Apps Script relay, throw an exception, or simply close the transaction entirely.
This is a remarkably elegant piece of C2 engineering. Instead of hardcoding a fallback channel, the operators embedded decision logic directly into DNS responses, letting them redirect infected machines in near real time without touching the malware’s configuration file.
Perhaps the most striking capability is the framework’s ability to detect and repair a broken Google Apps Script deployment ID entirely through DNS. The module computes an MD5 hash of its stored deployment ID and checks it against a value returned via a .q subdomain query.
If there’s a mismatch, it retrieves a fresh ID byte-by-byte through sequential .p queries, reconstructing a 74-character deployment string from an initial length-prefixed response followed by 18 four-byte continuation chunks.
Once validated, the new ID is written back to the local configuration, letting the operator “rotate” the Google channel while the implant silently follows along. Complementing the communication module is rnp.dll, a broker component that masquerades as the legitimate RNP OpenPGP library.
It scans its host directory every second, loads the highest-versioned DLL from each vendor group, and routes messages between loaded components, enabling the framework to receive runtime upgrades without ever restarting the infected host.
This modularity mirrors patterns seen in other nation-state-adjacent toolkits, where operators prioritize resilience and stealth over monolithic payload design.
The infrastructure tells its own story. The domain studiotikva[.]com, Hebrew for “Studio Hope,” was originally registered in 2024, likely by a legitimate Israeli business, then expired in February 2026 and was re-registered by the threat actor in May 2026.
It now fronts a plausible-looking local business website while quietly routing DNS-based C2 traffic and hosting the actor-controlled backend, briefly exposed at api.studiotikva[.]com/ac during an upstream timeout.
By layering DNS-based decision logic on top of a trusted platform like Google Apps Script, CAV3RN’s operators are making network-based detection significantly harder; traffic to script.google.com routinely passes unnoticed through corporate proxies.
GReAT assesses that, given the framework’s development pace and modular architecture, CAV3RN will likely continue to expand its transport options and evasion techniques, warranting close monitoring by defenders in the region and beyond.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran 
