Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Researchers have been tracking the development of the Cavern command-and-control framework, which is used by Iranian nation-state hackers to target entities in Israel. The framework has continued to evolve, with new components being discovered through ongoing monitoring by Kaspersky, a Russian cybersecurity company. Kaspersky's monitoring, which began in December 2025, has revealed previously unreported elements of the framework. The Cavern framework is used to blend malicious activity into legitimate traffic, utilizing methods such as DNS and Google Apps Script. This blending of traffic allows the hackers to carry out attacks without being easily detected. The discovery of these new components provides further insight into the tactics used by the threat actors.