Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
- ID
- 14993
- Status
- summarized
- Published
- 18 Aug 2026, 1:41 AM
- Fetched
- 18 Aug 2026, 5:13 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 18 Aug 2026, 5:16 AM
- Tags
- Audience
- developers
What happened
Kaspersky reports new modules in the Cavern C2 framework, used by Iranian-linked group Cavern Manticore against Israeli entities. The toolkit now uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay, and a module called HOLLOWGRAPH abuses Microsoft 365 calendar events via the Graph API as a covert two-way C2 channel, dating events to 2050 to avoid detection.
Why it matters
Unless you are building or defending SaaS APIs that could be abused as relay or dead-drop infrastructure (Google Apps Script, Microsoft Graph calendar), this has little direct impact on your work. The concrete takeaway for platform/security builders: legitimate cloud services like Google Apps Script and M365 Graph are increasingly used to hide malicious traffic, so rate-limiting and monitoring of script deployment IDs and calendar event anomalies may be worth reviewing.
Discussion angle
How cloud-native SaaS APIs (Google Apps Script, M365 Graph) are becoming attractive C2 relays because they blend into trusted traffic — and whether platform builders should treat this as their problem.