Iranian Cavern C2 Framework Evolves with DNS & Google Apps Script Stealth

Introduction

Iranian nation-state threat actors have quietly upgraded their Cavern command-and-control framework — also tracked as Cav3rn — with sophisticated evasion techniques that weaponize legitimate cloud services. According to new research from Kaspersky, the framework now incorporates DNS tunneling and Google Apps Script execution to blend malicious communications into routine network traffic, specifically targeting organizations in Israel.

Since December 2025, Kaspersky's threat intelligence teams have monitored continuous development across the Cavern ecosystem, uncovering previously undocumented modules that expand operational flexibility while reducing detection surface. These findings signal a maturing tradecraft that prioritizes persistence through obscurity over brute-force exploitation.

Anatomy of the Updated Cavern Framework

The latest Cavern iteration introduces a modular architecture where each component serves a distinct operational purpose:

• DNS Tunneling Layer: Encodes C2 commands and exfiltrated data within DNS queries and responses, exploiting the near-universal trust placed in DNS resolution.
• Google Apps Script Bridge: Leverages Google's serverless scripting platform to host relay logic, allowing payloads to execute within Google's trusted IP space.
• Pluggable Payload Handlers: Supports dynamic loading of post-exploitation modules — credential harvesters, lateral movement tools, and data staging utilities — without modifying the core implant.
• Configurable Jitter & Beaconing: Implements randomized sleep intervals and domain rotation to defeat statistical anomaly detection.

Notably, the framework avoids traditional HTTP/S C2 channels entirely, instead routing all operator-implant communication through the DNS-Apps Script pipeline. This design choice reflects deep understanding of enterprise security stacks that heavily inspect web traffic but often under-monitor DNS anomalies.

Operational Significance of Google Apps Script Abuse

Weaponizing Google Apps Script (GAS) represents a calculated tradecraft decision. GAS provides:

• Reputation Shielding: Traffic originates from Google's infrastructure, bypassing IP-based blocklists and reputation filters.
• Serverless Persistence: No dedicated hosting infrastructure to seize or sinkhole; scripts persist within the attacker's Google Workspace account.
• Legitimate Functionality Cover: Scripts can mimic legitimate automation — spreadsheet updates, calendar events, form submissions — further camouflaging malicious logic.
• Low Cost, High Availability: Free tier quotas suffice for low-and-slow beaconing; no domain registration or VPS overhead.

Kaspersky observed GAS endpoints acting as intermediate proxies: the implant sends DNS queries to attacker-controlled domains, which resolve to instructions triggering GAS web apps. Those web apps then fetch secondary payloads from Google Drive or external storage, returning results via the same DNS channel. This multi-hop design complicates attribution and forensic reconstruction.

Targeting Patterns and Victimology

Telemetry indicates a concentrated focus on Israeli entities across critical sectors:

• Government ministries and defense-adjacent contractors
• High-tech manufacturers and semiconductor firms
• Academic research institutions with dual-use technology programs
• Logistics and port operators supporting maritime supply chains

Initial access vectors remain consistent with prior campaigns: spear-phishing with Hebrew-language lures, exploitation of internet-facing vulnerabilities (notably in VPN gateways and mail servers), and supply-chain compromise of third-party service providers. Post-exploitation activity emphasizes credential theft, Active Directory reconnaissance, and staged exfiltration via the DNS channel — typically under 50 KB per day to evade volume-based alerts.

Detection Challenges and Defensive Gaps

Conventional security controls face significant blind spots against this tradecraft:

• DNS Monitoring Gaps: Many organizations lack recursive DNS logging or fail to correlate query entropy, frequency, and subdomain structure with threat models.
• Cloud Service Allowlisting: Google Workspace domains are universally allowlisted; blocking them breaks legitimate productivity workflows.
• Encrypted Payload Obfuscation: DNS tunnels often employ custom encryption (XOR, AES-GCM) before Base64/32 encoding, defeating signature-based inspection.
• Living-off-the-Land Ambiguity: GAS execution leaves minimal host artifacts — no binary drops, no scheduled tasks, no service installations.

Effective detection requires behavioral analytics: correlating anomalous DNS query patterns from specific hosts with unusual GAS API calls (via Google Workspace logs) and endpoint process trees showing script interpreters (wscript, cscript, powershell) making outbound DNS requests.

Conclusion

The Cavern C2 framework's latest iteration exemplifies how nation-state actors continuously refine tradecraft to exploit the trust boundaries inherent in modern cloud architectures. DNS tunneling and Google Apps Script abuse represent a potent combination: one exploits a protocol few organizations monitor deeply, the other hides behind a platform few can afford to block.

For security teams, the lesson is clear — visibility into DNS and cloud service activity must match the sophistication of the adversary. Signature-based defenses will continue to fail against infrastructure-less C2. Behavioral analytics, cross-log correlation, and AI-augmented threat hunting are now baseline requirements.

Grivyonx Cloud helps organizations close these visibility gaps with autonomous AI agents that continuously model normal DNS and cloud behavior, detect deviations in real time, and execute containment without human latency. In a threat landscape where stealth is the primary weapon, automated intelligence is the only sustainable countermeasure.