TLDR Tech / InfoSec
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection
Kaspersky researchers uncovered an updated Project CAV3RN espionage framework targeting Israeli organizations that dynamically routes command-and-control traffic by inspecting DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay. This evasive technique allows the malware to blend seamlessly with legitimate traffic before handing execution to an inter-component broker (rnp.dll) that orchestrates malicious modules. To detect this activity, defenders should flag anomalous script.google[.]com POST requests and hunt for associated infrastructure, specifically queries resolving to studiotikva[.]com.
Read the full story