Project CAV3RN has expanded its cyberespionage toolkit with a new command-and-control (C2) system that conceals traffic through Google Apps Script This article explores named googleservice dll. . The malware uses DNS A-record responses to determine whether each request should be routed via a Google relay or directly to an attacker-controlled HTTPS server.
A newly identified communication component, named GoogleService.dll, is a 64-bit .NET 8 NativeAOT module. It collaborates with a local DLL broker, enabling operators to load, manage, and upgrade framework components while maintaining the host's operational integrity. This offers operators a lightweight management system where they can adjust communication routes without updating the malware or deploying additional payloads. When DNS selects Google mode, CAV3RN constructs a URL using the script.google.com/macros/s/{deployment-ID}/exec format.
The malware sends a POST request to the Apps Script deployment, but instructs the relay to make a GET request to the upstream C2 server, as SecureList has reported. Indicators of Compromise IOC Type Indicator Description MD5 Hash 904784c9943d019da332bea2cd03996f CommunicationUxTheme.dll MD5 Hash f9156d42410c8a5429dec43329bd72e0 net.dll Enhance threat detection and response times by leveraging browser-based data analysis capabilities from ANY.RUN. Monitor for comprehensive phishing insights to bolster your Security Operations Center (SOC) and minimize Mean Time To Repair (MTTR).
