Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel.
Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the toolkit’s communication capabilities.
“The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction,” Kaspersky said in an analysis. “The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel.”
Cavern, first publicly documented by Check Point Research in early July 2026, consists of multiple moving parts, including an Agent and an assortment of modules, that work in tandem to enable mission-specific post-exploitation functionality, while minimizing forensic visibility and ensuring persistent access.
The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling. The use of Cavern C2 has been linked to Cavern Manticore, a hacking group affiliated with Iran’s Ministry of Intelligence and Security (MOIS) that shares overlaps with MuddyWater and an OilRig sub-group known as Lyceum.
Two back-to-back follow-up reports from Group-IB and Kaspersky detailed another module dubbed HOLLOWGRAPH that turns Microsoft 365 calendars into covert C2 channels. The malware, in particular, abuses the Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.
“Using the Microsoft Graph API, it treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached,” Group-IB noted. “To avoid catching the mailbox owner’s attention, every event is dated far into the future — 13 May 2050 — with payloads attached as files to the event.”
In tandem, the malware employs DNS tunneling as a way to refresh the Microsoft Entra ID (Azure AD) credentials used to authenticate to the Graph API and write the updated values to a text file on disk. A .NET NativeAOT-compiled DLL, HOLLOWGRAPH, was first detected in the wild on June 7, 2026.
Cavern’s shift to a modular, extensible architecture using a plugin-based system is assessed to have taken place in late April 2026, per Kaspersky, which has since linked it to OilRig (aka APT34) with low confidence, citing the following indicators despite no direct code reuse or infrastructure overlap –
- Use of Microsoft-hosted services for C2 (e.g., RDAT, OilCheck)
- Presence of secondary recovery mechanism to obtain replacement OAuth refresh tokens, as observed in OilBooster
- Use of compromised infrastructure belonging to entities in regions it targets, as observed in Solar and Veaty malware
The latest findings from Kaspersky are a new communication module, GoogleService.dll, which reads a configuration file from disk (“conf.json”) and performs a DNS A-record query to opt for either a direct HTTPS or a Google Apps Script relay for each transaction.
When the Google mode is selected, the module sends requests to the Apps Script deployment, which then forwards them to the threat actor-controlled backend. If Direct HTTPS is chosen by DNS, it contacts the configured address without using the relay.
The cybersecurity vendor said it also discovered an inter-component broker (“rnp.dll”) that functions as the framework’s local bridge, which discovers and loads DLL components, routes messages between them, and supports runtime upgrades. Although the primary domain linked to the activity (“studiotikva[.]com”) was first registered in February 2024, the domain is said to have expired in February 2026, only for it to be re-registered three months later.
The development is a sign of ongoing evolution of the Cavern framework, while relying on legitimate services to evade conventional perimeter defenses.
“By abusing legitimate services — previously Outlook calendar events and now Google Apps Script — the framework blends its C2 traffic with normal network activity, complicating network-based detection,” Kaspersky said. “Given its development pace, modular design, and operational tempo, we assess that Cav3rn will likely continue to expand.”
APT42 Resurfaces with TAMECAT
The disclosure comes as DarkAtlas detailed APT42’s use of TAMECAT in spear-phishing attacks targeting individuals associated with the nuclear energy sector as recently as April and May 2026 via LNK files masquerading as PDF documents.
“The social-engineering theme used podcast and interview invitations, continuing the group’s preference for credible professional engagement before malware delivery,” DarkAtlas said.
The attack chain culminates in the deployment of TAMECAT, a modular surveillance and collection framework that supports enumeration, discovery, arbitrary command execution, browser credential and cookie collection, Outlook .ost mailbox collection, screenshot capture, and fallback C2 and exfiltration mechanisms.
The Iranian hacking group has also been observed using generative artificial intelligence (AI) as a way to accelerate operations, including developing specialized tooling, researching exploitation techniques, language translation, and identifying official email addresses, and investigating entities of interest.
“APT42 remains an intelligence-collection threat whose advantage comes from patient human targeting, now accelerated by AI and supported by more resilient malware when needed,” DarkAtlas said.
