securelist.com· Aug 11, 2026· by GReAT

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN targets Israel with Google Apps Script C2 relays and DNS-based routing. Modular .NET NativeAOT framework blends C2 traffic with legitimate Google services to evade detection.

🎯 Vulnerability: Web Security Vulnerability

💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.

#GReAT research#Malware descriptions#Malware Technologies#OpenPGP#Google Apps Script#HTTPS#Malware Descriptions#DNS

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

More Writeups Like This

New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration

Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia