Project CAV3RN Expands Espionage Capabilities with Google Apps Script in Israel

Project CAV3RN, a modular espionage framework targeting entities in Israel, has recently expanded its capabilities by integrating Google Apps Script into its command and control (C2) infrastructure. This development follows two previous reports detailing the framework’s architecture and operational methods, with the latest findings published in August 2026 by the Kaspersky Threat Intelligence Reporting service and Securelist.

Recent investigations have uncovered new components that enhance CAV3RN’s communication and orchestration capabilities. A significant advancement is the introduction of a complex C2 module that utilizes DNS A-record responses to dynamically select between direct HTTPS connections and a Google Apps Script relay for each transaction. This dual-channel approach allows operators to validate and rotate the Google channel deployment ID, thereby enhancing the framework’s stealth and adaptability.

Multi-Transport C2 Communication Module

The newly identified communication module, GoogleService.dll, is a 64-bit dynamic link library (DLL) compiled with Microsoft .NET 8 NativeAOT. It is designed to facilitate communication between various components of the CAV3RN framework. The module exports several functions, including GroupByCategory, CheckAvailability, IsPrimeNumber, and OrderByDate, which are essential for its operational efficiency.

Upon initialization, the local broker registers the module’s callback and initiates a check for availability. The communication module then sends a type-0 frame to a fixed identifier, awaiting a response that confirms its connection to the broker. This interaction is crucial for establishing a reliable communication channel, which is further utilized for sending and receiving commands.

Data packets exchanged between the communication module and the broker contain structured information, including command types and payloads. The module supports several internal commands, such as s_version, which automatically reports the DLL version inventory upon startup, and s_config, which allows for configuration updates in memory.

Google Apps Script Channel

When the DNS mechanism selects the Google mode, the module constructs a URL for the Google Apps Script deployment, allowing it to relay commands through a seemingly benign service. Direct GET requests to this URL return a decoy page, while actual C2 polling is conducted via a POST request that instructs the relay to fetch data from an upstream server.

This method of leveraging Google Apps Script not only obscures the malicious activity but also complicates detection efforts, as the traffic appears similar to legitimate application requests. The framework’s ability to switch between Google Apps Script and direct HTTPS channels based on DNS responses further enhances its resilience against detection.

Infrastructure and Implications

The infrastructure supporting Project CAV3RN has evolved significantly, with the domain studiotikva.com playing a central role. Initially registered in February 2024, the domain has undergone several changes, including expiration and re-registration, which may indicate a strategic acquisition by threat actors. The domain now serves as a host for both authoritative DNS and direct HTTPS C2 communications, while the Google Apps Script deployment acts as an application-layer relay.

As CAV3RN continues to develop, its use of legitimate services for malicious purposes raises concerns about the increasing sophistication of cyber espionage tactics. By blending its C2 traffic with normal network activity, the framework poses a significant challenge for cybersecurity professionals tasked with detecting and mitigating such threats.

In conclusion, the ongoing evolution of Project CAV3RN highlights the need for continuous monitoring and adaptation in cybersecurity strategies. As the framework expands its capabilities, it is likely to remain a persistent threat, necessitating vigilance from organizations operating within its target regions.

For further details on this evolving threat, refer to the full report on Securelist: Project CAV3RN Expands Espionage Capabilities with Google Apps Script in Israel.