Do Son 
Project CAV3RN architecture | Image: Kaspersky Labs
At a glance
| Threat actor | Project CAV3RN cluster; linked to OilRig (APT34) with low confidence |
| Activity type | Cyberespionage; modular framework with a new Microsoft Graph C2 module |
| Targets / victims | Organizations in Israel, including a compromised Israeli law firm mailbox |
| Scale | Tracked since December 2025; active through May 2026; victim count not disclosed |
| Law-enforcement status | Nation-state espionage; no arrests; attribution low confidence |
| Source | Kaspersky GReAT (Securelist), with Check Point and Group-IB corroboration |
TL;DR
Kaspersky found a new communication module for Project CAV3RN, an espionage framework aimed at Israel. It hides commands inside Outlook calendar events accessed through Microsoft Graph. If that channel fails, the malware pulls fresh settings from DNS AAAA records.
What happened
On July 21, 2026, Kaspersky’s GReAT team detailed a new Project CAV3RN module. The framework targets organizations in Israel. Researchers have tracked it since December 2025.
CAV3RN has shifted shape fast. It began as a three-part downloader, executor, and uploader. By April 2026, it moved to a controller-and-plugin design. The controller manages a seven-character Agent ID and farms tasks out to plugins. This new module simply swaps the transport those parts use.
The new module, AzureCommunication.dll, replaces an older HTTP/WebSocket component. It turns a mailbox calendar into a dead drop. Operators place commands in calendar events dated to the year 2050. According to Kaspersky, that far-future date “makes them unlikely to appear in ordinary calendar views.”
Each event carries encrypted attachments. The malware downloads a command, decrypts it, then deletes the event. It sends results back the same way, as fresh encrypted attachments. The abused mailbox belongs to an Israeli law firm.
How the calendar channel works
Each agent uses fixed event subjects to sort traffic. One subject holds commands, another marks heartbeats, and a third carries results. The module encrypts every payload with RSA and AES-GCM. Only the operators hold the matching private key for outbound results.
A DNS backup channel
The module also ships a fallback channel. If Microsoft Graph login or tenant checks fail, it queries DNS instead. It reads IPv6 AAAA answers as raw data, not as addresses. From those bytes, it rebuilds tenant and credential settings. A sentinel IPv6 address signals failure, and the module then stops. Notably, the fallback rotates only credentials, not the domain or keys. The recovery domain is cloudlanecdn[.]com, registered in December 2025.
Who is behind it
Attribution stays cautious. Kaspersky links Project CAV3RN to the Iran-nexus group OilRig, also known as APT34. Still, the team holds this view with low confidence. As Kaspersky puts it, “we retain our low-confidence assessment that Project CAV3RN is associated with OilRig.”
Several clues support the link. OilRig has long abused Microsoft-hosted services for C2. Past tools used Exchange email, Office 365 drafts, and Outlook drafts. This module uses calendar events instead. The group has also reused victims’ own infrastructure before.
Independent teams reached similar ground. Check Point Research tracked the same framework as “Cavern Manticore,” an Iran-linked C2 system. Group-IB also documented the communication component. However, Kaspersky found no direct code reuse, so the OilRig tie remains an assessment, not proof.
Impact or scale
The campaign focuses on espionage, not theft. So the risk is data exposure, not ransom. Kaspersky has not published a victim count. The known target is one Israeli law firm’s Microsoft 365 mailbox.
Calendar-based C2 is a growing trend. Attackers favor trusted cloud services because they dodge simple network blocks. Microsoft Graph traffic rarely looks out of place. That makes this class of abuse hard to catch without cloud-side logging.
What comes next
Kaspersky says the framework keeps changing. The team notes that development stays active. So more modules and updates are likely.
Defenders can act now. First, review the published indicators, including the domain cloudlanecdn[.]com. Next, hunt for calendar events dated to 2050 in Microsoft 365 mailboxes. Also watch for odd Graph API calls from servers that rarely use them. Finally, flag AAAA lookups to unknown domains that return non-routable data.
Strong app-registration controls help too. Limit which apps can read mailboxes through Graph. That step shrinks the space these calendar-based C2 tricks rely on.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
