Fast Facts
- The threat employs a sophisticated communication system using Outlook calendar events and DNS AAAA records for command and data exchange, evading traditional detection methods.
- It decrypts and reconstructs encrypted commands and results through RSA and AES-GCM, enabling covert exfiltration of sensitive intelligence.
- The activity is linked to a highly active threat actor, potentially OilRig, leveraging compromised Microsoft 365 mailboxes and infrastructure for resilient, stealthy cyberespionage.
Threat, Techniques, and Targets
The report focuses on a cyber espionage threat linked to Project CAV3RN, a modular framework used mainly against targets in Israel. Recently, the developers replaced parts of this framework to improve communication. They shifted from HTTP/WebSocket channels to a new module that communicates via Outlook calendar events accessed through Microsoft Graph. The threat actors use a .NET Native AOT DLL named AzureCommunication.dll for communication, which makes analysis difficult because it hides much of its structure. They target Microsoft 365 accounts, specifically using Outlook calendars to exchange commands, results, and heartbeats. These exchanges happen within a fixed one-hour window, but scheduled far into the future to avoid detection. If Microsoft Graph authentication fails, the module uses DNS AAAA records from a compromised domain to recover connection settings. The communication flow includes encrypted commands using RSA and AES-GCM, with data stored as calendar event attachments, making it less obvious than traditional C2 channels.
Impact, Security Implications, and Guidance
This communication method allows threat actors to covertly control and gather intelligence from compromised systems. Since the module uses Outlook calendars and DNS responses, it can evade traditional detection strategies focused on network traffic. The actors can update commands and exfiltrate data through encrypted calendar events, making it a serious security concern. Also, the use of DNS AAAA records for configuration recovery enables the attackers to maintain persistence even if initial authentication fails. The impact includes potential espionage, data theft, and long-term covert access. Given the complex encryption and use of legitimate services, remediation efforts are challenging. Organizations should consult with their vendors or cybersecurity authorities for specific mitigation strategies, including monitoring for unusual calendar activities and DNS activities associated with these specific infrastructure indicators. Proper patching, vigilant monitoring, and tailored intrusion detection rules are strongly recommended.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
