THREAT OPS › Threat News › Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/11062112/project-CAV3RN-continues_2-990x400.jpg" width="990" /></p><p>Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first wa
Indicators of compromise
- 904784c9943d019da332bea2cd03996fmd5
- f9156d42410c8a5429dec43329bd72e0md5
- 2dcd4a8ac166404977cd3c48418a8cd9md5
- 981c7404d31b8ce35ec88a6b290f354dmd5
- 34d50eec364d920b8b5d885c9bc98607md5
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_tip-lnk_sm-team_c09760866e96002eurl
- https://api.studiotikva.com/api/v1/update/checkurl
- https://script.googleusercontent.com/macros/echo?user_content_key=AUkAhnT1XStTpObO…&lib=MQif1e23CL4IxZSlC7RWEgUDuxmmFKhYRurl
- https://api.studiotikva.com/acurl
- https://web.archive.org/web/20250417144902/https:/studiotikva.com/url
- https://opentip.kaspersky.com/904784c9943d019da332bea2cd03996f/results?icid=gl_sl_post-opentip_sm-team_007a144950a42c84&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f9156d42410c8a5429dec43329bd72e0/results?icid=gl_sl_post-opentip_sm-team_414f4a328e31a5df&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/2dcd4a8ac166404977cd3c48418a8cd9/results?icid=gl_sl_post-opentip_sm-team_5fa43c090727682e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/981c7404d31b8ce35ec88a6b290f354d/results?icid=gl_sl_post-opentip_sm-team_28bb96e3ed893870&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/34d50eec364d920b8b5d885c9bc98607/results?icid=gl_sl_post-opentip_sm-team_0af4d399236c27ea&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/studiotikva.com/results?icid=gl_sl_post-opentip_sm-team_c40e248c89115ab2&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/api.studiotikva.com/results?icid=gl_sl_post-opentip_sm-team_97df31546a430372&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ns1.studiotikva.com/results?icid=gl_sl_post-opentip_sm-team_419defd80420333f&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ns2.studiotikva.com/results?icid=gl_sl_post-opentip_sm-team_0bb46095a13ec0d0&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/144.172.115.17/results?icid=gl_sl_post-opentip_sm-team_12c63c70e27e4b40&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/144.172.104.82/results?icid=gl_sl_post-opentip_sm-team_1d4e476f8bb054db&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- intelreports@kaspersky.comemail
- 12.19.29.30ipv4
- 12.121.234.120ipv4
- 74.65.75.102ipv4
- 247.188.216.122ipv4
- 144.172.115.17ipv4
- 144.172.104.82ipv4
- media.kasperskycontenthub.comdomain
- ycz2.41414141303030.m.studiotikva.comdomain
- q.studiotikva.comdomain
- p.studiotikva.comdomain
Original source: https://securelist.com/project-cav3rn-continues/120991/