Executive Summary
Since December 2025, a sophisticated modular framework dubbed Project CAV3RN has been used in cyberespionage campaigns targeting organizations in Israel. Attributed with low confidence to the Iranian threat actor OilRig (APT34), the framework recently shifted to a controller-based architecture utilizing a .NET Native AOT communication module named AzureCommunication.dll.
The threat actor uses Microsoft Graph to access compromised Outlook mailboxes, specifically employing calendar events as a dead-drop C2 channel for command and result exchange. A unique technical highlight is the implementation of a DNS-based configuration recovery mechanism that uses actor-controlled AAAA responses to retrieve replacement Microsoft Entra credentials if primary Graph authentication fails. This development highlights the actor's persistence and focus on maintaining C2 through cloud-native and legitimate application protocols.
Project CAV3RN remains actively developed, with significant architectural changes observed as recently as mid-2026. Affected sectors include legal services and potentially others in the Middle East, posing a risk of long-term data exfiltration and persistent unauthorized access to Microsoft 365 environments.