Project CAV3RN - AzureCommunication.dll C2 Module Load

Georg Lauenstein@gsec

•updated Jul 27, 2026•2•0•8

Detects a process loading AzureCommunication.dll, the .NET Native AOT-compiled Outlook-calendar C2 module used by Project CAV3RN. The controller (uxtheme.dll) resolves this DLL's single export, QueryInterface, and passes it a get_;;_<agent-id>_,_<legacy-url> or send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading pattern that has no legitimate purpose on a host.