Key Takeaways
- The Cavern (Cav3rn) command‑and‑control framework used by Iranian state‑backed hackers has evolved into a modular, plug‑in based system that leverages legitimate cloud services to hide its traffic.
- Kaspersky’s latest analysis reveals a DNS‑driven switch between direct HTTPS and a Google Apps Script relay, enabling operators to rotate C2 channels on a per‑transaction basis.
- A complementary module, HOLLOWGRAPH, abuses Microsoft 365 calendar events via the Graph API to create a covert two‑way dead‑drop, while DNS tunneling refreshes the Azure AD credentials needed for API access.
- The framework’s inter‑component broker (rnp.dll) dynamically loads DLL components, routes messages, and supports runtime upgrades, enhancing flexibility and persistence.
- Cavern’s infrastructure shows low‑confidence ties to OilRig (APT34) through shared tactics such as Microsoft‑hosted C2, OAuth token recovery, and use of compromised regional assets.
- APT42 has resurfaced with the TAMECAT framework, employing spear‑phishing LNK files disguised as PDFs and leveraging generative AI to accelerate tool development, reconnaissance, and targeting.
- Both Cavern and TAMECAT illustrate how Iranian threat actors blend legitimate services, AI assistance, and modular malware to evade detection and sustain long‑running espionage campaigns.
Overview of the Cavern (Cav3rn) C2 Framework
Cybersecurity researchers have traced the continued evolution of the Cavern (also known as Cav3rn) command‑and‑control framework employed by Iranian nation‑state hackers in operations targeting Israeli entities. First publicly documented by Check Point Research in early July 2026, Cavern consists of an Agent and a variety of modules that work together to deliver mission‑specific post‑exploitation capabilities while striving to minimize forensic footprints and maintain persistent access. The framework’s design emphasizes stealth, flexibility, and the ability to blend with legitimate network traffic.
Core Functional Modules and Capabilities
The Cavern toolkit includes modules that enable file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute‑force attacks, network reconnaissance, and the establishment of SOCKS5 proxies and WebSocket tunnels. These components allow attackers to harvest credentials, move laterally within compromised environments, exfiltrate data, and maintain covert channels for ongoing espionage. The modular nature means that operators can load only the functionality needed for a particular operation, reducing the malware’s detectable footprint.
Linkage to Iranian Threat Actors
Cavern’s usage has been attributed to Cavern Manticore, a hacking group affiliated with Iran’s Ministry of Intelligence and Security (MOIS). This group shares tactical overlaps with the MuddyWater threat cluster and an OilRig sub‑group known as Lyceum. Although direct code reuse or infrastructure overlap with OilRig (APT34) has not been observed, analysts note behavioral similarities that suggest a low‑confidence association, particularly in the use of Microsoft‑hosted services for C2 and the reliance on compromised regional infrastructure.
Introduction of the HOLLOWGRAPH Calendar‑Based C2 Channel
Back‑to‑back follow‑up reports from Group‑IB and Kaspersky unveiled a novel module dubbed HOLLOWGRAPH that turns Microsoft 365 calendars into covert command‑and‑control channels. By leveraging the Microsoft Graph API, the implant treats a compromised mailbox’s calendar as a two‑way dead‑drop: operators embed tasking as calendar events, while the malware exfiltrates stolen data by creating its own events containing encrypted payloads. To avoid alerting the mailbox owner, every malicious event is dated far in the future—13 May 2050—with the payload attached as a file. In parallel, HOLLOWGRAPH employs DNS tunneling to refresh the Microsoft Entra ID (Azure AD) credentials required for Graph API authentication, writing the updated values to a local text file. The .NET NativeAOT‑compiled DLL was first spotted in the wild on June 7, 2026.
DNS‑Driven Switching Between HTTPS and Google Apps Script Relay
Kaspersky’s ongoing monitoring since December 2025 uncovered a sophisticated C2 module that uses DNS A‑record responses to decide, for each transaction, whether to communicate via direct HTTPS or through a Google Apps Script relay. When the DNS query indicates the Google mode, the module forwards requests to the Apps Script deployment, which then relays them to the threat‑actor‑controlled backend. If the DNS answer favors direct HTTPS, the module contacts the configured address without intermediary relaying. This mechanism also allows the operator to validate and replace the relay deployment ID, enabling rapid rotation of the Google channel and further obscuring the C2 infrastructure.
Inter‑Component Broker and Runtime Flexibility
In addition to the communication module, researchers identified an inter‑component broker named rnp.dll. This broker acts as the framework’s local bridge: it discovers and loads DLL components residing on disk, routes messages between them, and supports runtime upgrades. By dynamically loading plugins, the broker lets operators add or replace functionality without redeploying the entire implant, enhancing both agility and stealth. The primary domain associated with the activity, studiotikva[.]com, was first registered in February 2024, expired in February 2026, and was re‑registered three months later—a pattern consistent with the group’s attempts to maintain persistence while evading domain‑based blacklists.
Assessment of Links to OilRig (APT34)
Kaspersky assesses, with low confidence, that Cavern’s shift to a modular, extensible, plugin‑based architecture—which occurred around late April 2026—may be linked to OilRig (APT34). The basis for this assessment includes three observed similarities: the use of Microsoft‑hosted services for C2 (e.g., RDAT, OilCheck), the presence of a secondary recovery mechanism to obtain replacement OAuth refresh tokens (as seen in OilBooster malware), and the employment of compromised infrastructure belonging to entities in the regions targeted by the attackers (observed in earlier Solar and Veaty malware). While no direct code reuse or infrastructure overlap has been confirmed, these tactical convergences suggest a possible exchange of techniques or shared development resources.
Evasion Through Legitimate Services and Future Outlook
By abusing legitimate services—first Outlook calendar events and now Google Apps Script—Cavern blends its C2 traffic with ordinary network activity, complicating detection via traditional perimeter defenses. The framework’s rapid development pace, modular design, and high operational tempo lead analysts to conclude that Cavern will likely continue to expand its capabilities and adopt new evasion techniques. Continuous monitoring of DNS‑based service selection, plugin loading mechanisms, and abuse of cloud APIs will be essential for defenders seeking to counter this evolving threat.
APT42 Resurfaces with the TAMECAT Framework
In parallel to Cavern’s advancements, DarkAtlas reported that APT42 has resurfaced using a new modular surveillance and collection framework called TAMECAT in spear‑phishing campaigns targeting individuals linked to the nuclear energy sector during April and May 2026. The attack chain begins with LNK files masquerading as PDF documents, delivered via phishing emails that employ social‑engineering lures such as podcast or interview invitations—consistent with APT42’s preference for credible professional engagement before malware deployment. Once executed, TAMECAT provides a broad suite of capabilities: system enumeration, discovery, arbitrary command execution, browser credential and cookie collection, extraction of Outlook .ost mailboxes, screenshot capture, and fallback C2 and exfiltration mechanisms.
AI‑Assisted Operations by APT42
Notably, APT42 has been observed incorporating generative artificial intelligence into its workflow. The group uses AI to accelerate the development of specialized tooling, research exploitation techniques, perform language translation, identify official email addresses, and investigate entities of interest. This AI augmentation shortens the time required to craft convincing lures, tailor malware to specific targets, and refine reconnaissance efforts, thereby increasing the overall efficiency of their intelligence‑collection operations.
Strategic Implications of APT42’s Evolution
DarkAtlas characterizes APT42 as an intelligence‑collection threat whose primary advantage lies in patient, human‑centric targeting. The integration of AI does not replace this core strategy but amplifies it, enabling the group to scale its efforts while maintaining the low‑noise, high‑precision approach that has historically defined its campaigns. Coupled with more resilient malware when needed, APT42 remains a formidable adversary capable of sustained espionage against high‑value sectors such as energy, defense, and diplomacy.
Conclusion
The latest findings underscore a dual trend among Iranian‑linked threat actors: the continual refinement of modular, service‑abusing C2 frameworks like Cavern, and the innovative use of AI‑enhanced toolkits such as TAMECAT by groups like APT42. Both developments emphasize the importance of detecting anomalous use of legitimate cloud services, monitoring DNS‑based traffic shifts, and employing behavior‑based analytics that can identify the subtle signs of plugin‑based malware and AI‑assisted reconnaissance. Defenders who adapt their telemetry and detection strategies to these evolving tactics will be better positioned to mitigate the persistent espionage campaigns emanating from these threat actors.