Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN, a modular espionage framework used against targets in Israel, continues to evolve, utilizing a sophisticated multi-transport C2 communication module. The framework now leverages DNS A-record responses to dynamically select between direct HTTPS and a Google Apps Script relay, with the latter acting as an application-layer proxy. A key component is the ‘studioTikva’ domain, which initially appeared to be associated with Wix infrastructure but was later determined to be controlled by the threat actor. The framework employs a local broker to manage DLL components, facilitating updates and communication, and uses a Google Apps Script deployment to mask C2 traffic within legitimate Google services. The threat actor leverages a complex interplay of DNS, HTTPS, and Google services to evade detection and maintain operational tempo.