Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Overview

Cybersecurity researchers at Kaspersky have documented a significant evolution in the Cavern (also tracked as Cav3rn) command-and-control (C2) framework, attributed to Iranian nation-state threat actors conducting operations against entities in Israel. The updated framework employs a dual-channel communication strategy using DNS tunneling and Google Apps Script as relay mechanisms, allowing malicious traffic to blend seamlessly with legitimate organizational network activity.

The Cavern C2 Framework

Cavern is a purpose-built C2 framework developed and maintained by an Iranian advanced persistent threat (APT) group that Kaspersky has been tracking over an extended monitoring period. The framework has undergone continuous refinement, with each iteration introducing new techniques to evade network-based detection and frustrate incident response efforts.

The current generation of Cavern distinguishes itself through its use of two distinct covert channels for operator-to-implant communication:

Channel 1: DNS Tunneling

The first communication channel abuses the Domain Name System (DNS) protocol to encode C2 commands and responses within DNS query and reply data. DNS tunneling is a well-established technique for exfiltrating data and establishing covert channels, but Cavern's implementation includes several characteristics that make it harder to detect:

• Commands are split across multiple DNS query types (TXT, A, MX records) to reduce payload size and avoid triggering volume-based anomaly detection
• Query cadence is deliberately throttled to mimic organic DNS resolution patterns
• Subdomain structure mimics legitimate CDN and analytics domains to pass superficial inspection

Because DNS traffic is ubiquitous and frequently excluded from deep packet inspection at organizational boundaries, DNS-based C2 channels can persist undetected for extended periods.

Channel 2: Google Apps Script as a Relay

The second channel leverages Google Apps Script — Google's JavaScript-based scripting platform for automating Google Workspace applications — as a trusted relay for C2 communications. Operators deliver commands by writing data to a Google Apps Script deployment, which the implant polls over HTTPS.

This approach is notable for several reasons:

• Traffic blends with Google Workspace activity — outbound connections to script.google.com and *.googleapis.com are common in enterprise environments and rarely blocked
• Google's infrastructure provides TLS termination — the C2 channel benefits from Google's certificate authority trust and is indistinguishable at the network layer from legitimate Workspace API calls
• No attacker-controlled infrastructure required at the transport layer — defenders cannot block the C2 channel by blacklisting attacker-owned IP ranges or domains

Attribution and Targeting

Kaspersky attributes the Cavern framework to an Iranian APT cluster with a documented history of operations against Israeli targets. The research does not name a specific group designation in the available reporting, but the targeting profile — Israeli entities across technology, defense, and critical infrastructure sectors — aligns with known Iranian threat actor priorities.

The use of living-off-the-land techniques and trusted cloud services reflects a broader operational security (OPSEC) maturation among Iranian state-sponsored actors, who have increasingly adopted techniques previously associated with more technically sophisticated adversaries.

Detection Challenges

The dual-channel architecture presents significant detection challenges for defenders:

Defensive Recommendations

Despite the detection challenges, several defensive measures can reduce exposure to Cavern-style C2 frameworks:

• DNS-over-HTTPS (DoH) logging and inspection — enforce centralized DNS resolution and log all queries for anomaly analysis, including unusual subdomain patterns and high-entropy query names
• Google Workspace API monitoring — if your organization uses Google Workspace, enable audit logging for Apps Script deployments and monitor for unexpected script executions or outbound data volumes
• Zero-trust network segmentation — restrict which endpoints can initiate outbound DNS and HTTPS connections; workstations running sensitive applications should not have broad internet egress
• Endpoint detection and response (EDR) — look for process behaviors consistent with DNS tunnel clients: unusual DNS query rates from non-browser processes, or periodic HTTPS polling to Google APIs from unexpected applications
• Threat intelligence integration — ingest Kaspersky and community threat intelligence feeds for known Cavern IOCs and TTPs aligned with the MITRE ATT&CK framework

Broader Context: Cloud Services as C2 Infrastructure

Cavern's use of Google Apps Script is part of a broader trend in which threat actors abuse legitimate cloud platforms for C2 communications. Similar techniques have been documented using Microsoft OneDrive, Slack, Discord, Telegram, and Dropbox as relay infrastructure. The common thread: by routing communications through platforms that organizations trust and cannot realistically block, adversaries shift the detection burden entirely to endpoint and behavioral analytics.

This trend underscores the importance of investing in endpoint visibility and behavioral analytics rather than relying solely on perimeter-based blocking — a network that allows Google traffic cannot block Cavern's second channel by policy alone.

References

• The Hacker News: Cavern C2 Analysis
• Kaspersky Threat Intelligence
• MITRE ATT&CK: DNS Tunneling (T1071.004)