PROJECT CAV3RN CONTINUES: GOOGLE APPS SCRIPT AS C2 RELAY AND DNS-BASED C2 CHANNEL SELECTION

Summary from the TLDR InfoSec newsletter

Kaspersky researchers uncovered an updated Project CAV3RN espionage framework targeting Israeli organizations that dynamically routes command-and-control traffic by inspecting DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay. This evasive technique allows the malware to blend seamlessly with legitimate traffic before handing execution to an inter-component broker (⁠rnp.dll⁠) that orchestrates malicious modules. To detect this activity, defenders should flag anomalous ⁠script.google[.]com⁠ POST requests and hunt for associated infrastructure, specifically queries resolving to ⁠studiotikva[.]com⁠.