Cybersecurity researchers are closely tracking the continuous evolution of the **Cavern** (aka Cav3rn) command-and-control (C2) framework, actively employed by Iranian nation-state hackers against Israeli entities. **Kaspersky**, a Russian cybersecurity firm, revealed that its ongoing monitoring since December 2025 has led to the discovery of previously unreported components that significantly expand **Cavern**'s communication capabilities. "The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a **Google Apps Script** relay for each transaction," **Kaspersky** stated in its analysis. "The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel." **Cavern** was first publicly documented by **Check Point Research** in early July 2026. It comprises multiple interconnected parts, including an Agent and various modules, designed to execute post-exploitation functions while minimizing forensic visibility and ensuring persistent access. These modules facilitate diverse operations such as file manipulation, SQL database enumeration, **Active Directory** reconnaissance, LDAP brute-force attacks, network reconnaissance, and **SOCKS5** proxy and **WebSocket** tunneling. The **Cavern** C2 framework has been linked to **Cavern Manticore**, a hacking group associated with Iran's **Ministry of Intelligence and Security (MOIS)**, which shows overlaps with **MuddyWater** and an **OilRig** sub-group known as **Lyceum**. Subsequent reports from **Group-IB** and **Kaspersky** detailed another module, dubbed **HOLLOWGRAPH**, which covertly transforms **Microsoft 365** calendars into C2 channels. This malware specifically abuses the **Microsoft Graph API** to exfiltrate files and receive commands via **Microsoft 365** calendar events. It also employs DNS tunneling to refresh credentials for C2 communication. "Using the **Microsoft Graph API**, it treats the compromised mailbox's calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached," **Group-IB** noted. "To avoid catching the mailbox owner's attention, every event is dated far into the future — 13 May 2050 — with payloads attached as files to the event." Additionally, the malware utilizes DNS tunneling to refresh **Microsoft Entra ID (Azure AD)** credentials used for **Graph API** authentication, writing updated values to a text file. **HOLLOWGRAPH**, a .NET NativeAOT-compiled DLL, was first detected in June 2026. **Kaspersky** assesses that **Cavern**'s shift to a modular, extensible architecture, leveraging a plugin-based system, occurred in late April 2026. The firm has since linked it to **OilRig** (aka **APT34**) with low confidence, citing several indicators despite a lack of direct code reuse or infrastructure overlap: * Use of Microsoft-hosted services for C2 (e.g., **RDAT**, **OilCheck**) * Presence of a secondary recovery mechanism for **OAuth** refresh tokens, similar to **OilBooster** * Use of compromised infrastructure within targeted regions, as observed in **Solar** and **Veaty** malware The latest findings from **Kaspersky** include a new communication module, `GoogleService.dll`, which reads a configuration file (`conf.json`) and performs a DNS A-record query to select between direct HTTPS or a **Google Apps Script** relay for each transaction. In **Google** mode, requests are sent to the **Apps Script** deployment, which then forwards them to the threat actor's backend. If Direct HTTPS is chosen via DNS, the module directly contacts the configured address without using the relay. The cybersecurity vendor also uncovered an inter-component broker, `rnp.dll`, which functions as the framework's local bridge. It discovers and loads DLL components, routes messages between them, and supports runtime upgrades. The primary domain linked to this activity, `studiotikva[.]com`, was initially registered in February 2024, expired in February 2026, and was re-registered three months later. This development underscores the ongoing evolution of the **Cavern** framework, which increasingly relies on legitimate services to bypass conventional perimeter defenses. "By abusing legitimate services — previously **Outlook** calendar events and now **Google Apps Script** — the framework blends its C2 traffic with normal network activity, complicating network-based detection," **Kaspersky** emphasized. "Given its development pace, modular design, and operational tempo, we assess that **CAV3RN** will likely continue to expand." ### APT42 Resurfaces with TAMECAT and AI-Assisted Phishing In a parallel development, **DarkAtlas** has detailed **APT42**'s use of **TAMECAT** in spear-phishing attacks. These attacks, occurring as recently as April and May 2026, targeted individuals in the nuclear energy sector through LNK files disguised as PDF documents. "The social-engineering theme used podcast and interview invitations, continuing the group's preference for credible professional engagement before malware delivery," **DarkAtlas** reported. The attack chain culminates in the deployment of **TAMECAT**, a modular surveillance and collection framework. It supports enumeration, discovery, arbitrary command execution, browser credential and cookie collection, **Outlook** .ost mailbox collection, screenshot capture, and robust fallback C2 and exfiltration mechanisms. **APT42** has also been observed leveraging generative artificial intelligence (AI) to accelerate its operations. This includes developing specialized tooling, researching exploitation techniques, language translation, identifying official email addresses, and investigating entities of interest. "**APT42** remains an intelligence-collection threat whose advantage comes from patient human targeting, now accelerated by AI and supported by more resilient malware when needed," **DarkAtlas** concluded.