Kaspersky Details Cavern C2 Framework Evolution Blending DNS and Google Apps Script

Kaspersky researchers have been monitoring a threat activity cluster since December 2025 and have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control framework. This framework is used by Iranian nation-state hackers in attacks targeting entities in Israel.

The latest analysis reveals previously unreported components that expand the framework's capabilities. A key development is the integration of DNS tunneling and Google Apps Script, which allows the C2 infrastructure to blend into legitimate traffic. By exploiting these trusted channels, the threat actors can maintain covert communication with compromised systems while evading traditional security controls.

The targeted entities in Israel face risks of unauthorized access and data exfiltration. The use of DNS and Google Apps Script for C2 makes detection particularly challenging, as these protocols are commonly used in legitimate business operations. Kaspersky has not disclosed specific victim counts or the exact nature of the newly discovered components to avoid providing assistive instructions for exploitation, but the evolution indicates a sustained and adaptive campaign by the attributed threat actor.