CAV3RN Uses Google Apps Script as C2 Relay to Hide Malware Traffic Behind Google Infrastructure

CAV3RN is a modular espionage framework that becomes harder to detect on networks This article explores listed cav3rn associated. . Its latest communication component conceals remote-control traffic behind Google Apps Script, which many organizations use legitimately.

Researchers have not disclosed the initial infection route for this update, but once installed, its modules can exchange messages, collect software details, receive tasks, and update parts of the toolkit without restarting the host.

Indicators of compromise (IoCs):

• File name UxTheme.dll: CAV3RN-associated file listed in source
• File name net.dll: CAV3RN-associated file listed in source
• File name rnp.dll: CAV3RN local broker component
• File name GoogleService.dll: CAV3RN communication component
• File name texture.dll: CAV3RN-associated file listed in source
• Hash 904784c9943d019da332bea2cd03996f: Listed for a CAV3RN-associated file
• Hash f9156d42410c8a5429dec43329bd72e02: Listed for a CAV3RN-associated file
• Hash dcd4a8ac166404977cd3c48418a8cd998: Listed for a CAV3RN-associated file
• Hash 1c7404d31b8ce35ec88a6b290f354d: Listed for a CAV3RN-associated file
• Hash 34d50eec364d920b8b5d885c9bc98607: Listed for a CAV3RN-associated file Domain studiotikva[.]com: CAV3RN DNS control infrastructure Domain api.studiotikva[.]com: Direct HTTPS C2 backend Domain ns1.studiotikva[.]com: Authoritative DNS infrastructure Domain ns2.studiotikva[.]com: Authoritative DNS infrastructure IP address 144.172.115[.]17: Infrastructure IP address IP address 144.172.104[.]82: Infrastructure IP address URL hxxps://api.studiotikva[.]com/api/v1/update/check: Direct HTTPS C2

endpoint URL hxxps://api.studiotikva[. ]com/ac: Backend endpoint exposed during upstream timeout Integrate real-time threat intelligence from reputable sources like MISP, VirusTotal, or your SIEM to prevent potential breaches.