Cybersecurity experts have identified continued advancements in the Cavern command-and-control (C2) framework, used by Iranian hackers against targets in Israel. This evolution aims to blend malicious traffic with legitimate online activities.
New Communication Methods Discovered
Russian cybersecurity firm Kaspersky has been monitoring this threat since December 2025, revealing new components that enhance Cavern’s communication methods. A notable discovery is a sophisticated C2 module that chooses between using DNS A-records and Google Apps Script for communication, creating challenges for defense mechanisms.
First reported by Check Point Research in July 2026, Cavern is composed of various elements such as an Agent and multiple modules, enabling specific post-exploitation tasks while reducing detection and ensuring persistent access. These modules are equipped to handle file operations, network reconnaissance, and more.
Integration with Microsoft Services
Kaspersky and Group-IB have uncovered another module, HOLLOWGRAPH, which uses Microsoft 365 calendars as covert C2 channels. This malware exploits the Microsoft Graph API to extract data and send commands using calendar events, cleverly avoiding detection by setting events far into the future.
The malware also employs DNS tunneling to refresh credentials, utilizing a .NET NativeAOT-compiled DLL first seen in June 2026. The integration of legitimate services into Cavern’s framework complicates detection efforts, as the malicious traffic is masked within normal network operations.
Implications and Future Outlook
Kaspersky has linked Cavern’s modular architecture to OilRig, although with low confidence, due to certain similarities in tactics but without direct code or infrastructure overlap. This evolution signifies an ongoing adaptation to avoid detection by leveraging trusted services.
Meanwhile, APT42, another Iranian group, has been using TAMECAT in spear-phishing campaigns targeting the nuclear sector, highlighting a trend towards advanced social engineering tactics. This group’s operations are reportedly accelerated by AI, which helps in developing tools and conducting research.
The continuous development of the Cavern framework, with its reliance on legitimate services like Google Apps Script, poses a persistent threat to cybersecurity. As these frameworks evolve, organizations must stay vigilant and adapt their defenses accordingly.
