Fast Facts
- Iranian state-sponsored hackers leverage the Cavern framework’s modular, DNS- and Google Apps Script-based C2 channels to maintain persistent, covert access while blending with legitimate traffic.
- The malware abuses Microsoft 365 calendar events and DNS tunneling to exfiltrate data and refresh credentials, evading typical detection methods.
- APT42 resumes targeted espionage using spear-phishing with AI-enhanced tools and the TAMECAT framework for comprehensive surveillance and data collection from high-value sectors.
Threat, Techniques, and Targets
Cybersecurity researchers have identified the Cavern C2 framework, which is used by Iranian nation-state hackers. They have been monitoring this threat since December 2025. Cavern is a complex system that includes an agent and modules for various tasks. The attackers use this framework to communicate covertly. They blend their traffic with normal internet activity by using DNS responses and Google Apps Script. This makes detection difficult. The hackers target entities mainly in Israel. They focus on activities like network reconnaissance, Active Directory attacks, and file operations. The group behind Cavern is linked to Iran’s Ministry of Intelligence and Security. They also have developed other modules like HOLLOWGRAPH, which uses Microsoft 365 calendars as hidden communication channels. This module leverages the Microsoft Graph API and DNS tunneling to send commands and exfiltrate data. The framework continues to evolve, using legitimate services to stay hidden and avoid detection.
Impact, Security Implications, and Guidance
The use of Cavern allows attackers to avoid easy detection. They can hide their activity inside legitimate traffic, making it hard for security tools to identify. If compromised, organizations could face data theft, unauthorized access, or disruption of their systems. This threat’s development suggests it could target a variety of organizations or sectors. To protect against this, organizations should maintain strong security measures. They should monitor DNS traffic and API usage closely. It is also important to keep systems updated and use advanced detection tools. Because the threat continues to evolve, organizations should seek guidance from their security vendors or authorities. They need tailored advice on how to detect and block these types of covert channels effectively.
Stay Ahead with the Latest Tech Trends
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
