Project CAV3RN: Google Apps Script and DNS C2

Project CAV3RN is a sophisticated modular espionage framework active against targets in Israel. The framework has recently evolved to include a complex C2 module, GoogleService.dll, which utilizes multi-transport communication. It dynamically selects between direct HTTPS and a Google Apps Script relay based on DNS A-record responses, effectively blending malicious traffic with legitimate cloud service activity.

Technical analysis reveals a highly organized architecture consisting of an inter-component DLL broker (rnp.dll) that manages modular payloads and supports runtime upgrades without process restarts. The infrastructure relies on the domain studiotikva[.]com, which provides Israeli-themed cover and supports authoritative DNS for C2 orchestration. The use of Google Apps Script as an application-layer relay demonstrates a continued shift toward abusing trusted third-party services to bypass traditional network defenses.

This framework represents a significant threat due to its rapid development cycle and stealthy communication techniques. Organizations in the region should prioritize monitoring for anomalous DNS queries to actor-controlled subdomains and unauthorized use of Google Apps Script environments within their networks.