THREAT OPS › Threat News › New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/07/21074741/cav3rn-outlook-dns-featured-image-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>In June 2026, as part of <a href="https://www.kaspersky.com/enterprise-security/threat-intelli
Attributed threat actors
- OilRigG0049
MITRE ATT&CK techniques
Indicators of compromise
- caf021dda726b8ba049c2aa395e505a1md5
- c092b02fbc0fdf7ee9608dd016673806md5
- 29b2b8c5d99f05bfcdd0d8d976eb5678md5
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_tip-lnk_sm-team_c09760866e96002eurl
- https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/url
- https://www.pc.co.il/news/%D7%90%D7%91%D7%98%D7%97%D7%AA-%D7%9E%D7%99%D7%93%D7%A2-%D7%95%D7%A1%D7%99%D7%99%D7%91%D7%A8/453995/url
- https://www.group-ib.com/blog/hollowgraph-microsoft-365/url
- https://login.microsoftonline.com/<TenantId>/oauth2/v2.0/tokenurl
- https://research.checkpoint.com/2024/iranian-malware-attacks-iraqi-government/url
- https://opentip.kaspersky.com/caf021dda726b8ba049c2aa395e505a1/results?icid=gl_sl_post-opentip_sm-team_c4b157c88b945c01&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/c092b02fbc0fdf7ee9608dd016673806/results?icid=gl_sl_post-opentip_sm-team_b232dd89efa6bcfa&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/29b2b8c5d99f05bfcdd0d8d976eb5678/results?icid=gl_sl_post-opentip_sm-team_0b461c67de5cb905&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/cloudlanecdn.com/?icid=gl_sl_post-opentip_sm-team_6b8673195e5d9758&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ns1.cloudlanecdn.com/?icid=gl_sl_post-opentip_sm-team_1d242dcd3827f3fd&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ns2.cloudlanecdn.com/?icid=gl_sl_post-opentip_sm-team_1bd4dd255d33e734&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ns3.cloudlanecdn.com/?icid=gl_sl_post-opentip_sm-team_16eaa37ce32c4ea6&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ns4.cloudlanecdn.com/?icid=gl_sl_post-opentip_sm-team_4801f3c27b36a553&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/google.com.ayalon-print.co.il/?icid=gl_sl_post-opentip_sm-team_bdcbf6708a7d9934&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/clipeditskill.com/?icid=gl_sl_post-opentip_sm-team_1102210713d0f5ad&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/accesslinkssl.com/?icid=gl_sl_post-opentip_sm-team_6cb1ff154fe52387&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/216.126.237.197/?icid=gl_sl_post-opentip_sm-team_1ae34e6e0cfd913a&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/144.172.108.205/?icid=gl_sl_post-opentip_sm-team_fbb0c6283cbc16fa&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- intelreports@kaspersky.comemail
- 216.126.237.197ipv4
- 144.172.108.205ipv4
- 2001:24:1234:5678:9abc:def0:1122:3344ipv6
- media.kasperskycontenthub.comdomain
- d.53466d4c67515a.0.p.cloudlanecdn.comdomain
- dns1.registrar-servers.comdomain
- dns2.registrar-servers.comdomain