Iranian cyber operators have expanded the Cavern command-and-control framework with two new capabilities designed to blend malicious traffic with legitimate cloud service activity: a DNS-directed routing module that selects between direct HTTPS and a Google Apps Script relay, and a separate implant that uses Microsoft 365 calendar events as a covert dead-drop channel. A parallel campaign by APT42 is targeting nuclear energy sector personnel with a modular surveillance framework while using generative AI to accelerate operational tempo.
The Cavern C2 Framework
Cavern (also tracked as Cav3rn) was first publicly documented by Check Point Research in July 2026 as a modular post-exploitation framework linked to Cavern Manticore, a hacking group assessed by analysts to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS). The group shares infrastructure and operational patterns with MuddyWater and an OilRig sub-group known as Lyceum.
Kaspersky, which has tracked the activity cluster since December 2025, published new findings on 17 August detailing previously undisclosed components. The main addition is a communication module, GoogleService.dll, that reads a configuration file and performs a DNS A-record query at runtime to choose its C2 channel for each transaction. If the DNS response directs it to Google mode, traffic routes through a Google Apps Script deployment that forwards requests to the threat actor’s backend. If direct HTTPS is selected, it bypasses the relay entirely and contacts the configured address. The same DNS infrastructure can rotate the Google Apps Script deployment ID in real time, allowing operators to swap relay endpoints without redeploying the implant.
Kaspersky also documented an inter-component broker, rnp.dll, that functions as the local routing layer for the framework: loading DLL components at runtime, routing messages between them, and supporting in-place upgrades without full re-infection.
HOLLOWGRAPH: Microsoft 365 Calendars as C2
A related discovery by Group-IB describes HOLLOWGRAPH, a .NET NativeAOT-compiled implant first detected in the wild on 7 June 2026 that uses compromised Microsoft 365 mailboxes as a bidirectional command channel. The malware abuses the Microsoft Graph API to treat the victim’s calendar as a dead-drop: operators plant tasking as calendar events, and the implant reads these events and returns stolen files by creating its own events with encrypted data attached. Calendar events are dated to 13 May 2050 to avoid drawing the mailbox owner’s attention.
DNS tunneling handles credential refresh: HOLLOWGRAPH uses DNS to obtain replacement Microsoft Entra ID OAuth tokens when the current credentials age out, writing updated values to disk.
The technique follows an established pattern for Iranian operators — OilRig has previously used Microsoft Exchange and OneDrive as C2 channels — and represents a direct evolution toward legitimate-service abuse as a perimeter evasion strategy.
APT42 TAMECAT: Nuclear Sector Targeting with AI Acceleration
In a parallel development, DarkAtlas detailed active APT42 (Charming Kitten, IRGC-linked) spear-phishing targeting individuals associated with the nuclear energy sector as recently as April and May 2026. The lure theme used podcast and interview invitations delivered via LNK files masquerading as PDF documents.
The final payload, TAMECAT, is a modular surveillance and collection framework supporting enumeration, command execution, browser credential harvesting, Outlook .ost mailbox collection, screenshot capture, and fallback C2 mechanisms. APT42 has also been observed using generative AI to accelerate targeting: research, language translation, identification of official email addresses, and tooling development.
Implications for Affected Sectors
Organisations running Microsoft 365 in communications, finance, and critical infrastructure environments face a legitimacy problem: HOLLOWGRAPH traffic is indistinguishable from normal Graph API activity without calendar-level behavioural monitoring. Standard perimeter controls that inspect for known-bad domains or unusual external connections will not flag this traffic.
The Cavern framework’s DNS-directed relay selection adds another layer of evasion: if defenders are blocking the Google Apps Script relay, operators can switch to direct HTTPS at the DNS layer without touching deployed implants. This flexibility substantially increases the operational resilience of the framework against targeted blocking.
Nuclear energy sector organisations should treat any unsolicited professional outreach — podcast invitations, media inquiries, expert panel requests — as a potential TAMECAT delivery vector, particularly if the contact arrives as an LNK file attachment.
Recommended Actions
- Audit Microsoft 365 calendar sharing permissions and review audit logs for unusual calendar creation activity or Graph API calls originating from unfamiliar service principals.
- Monitor for DNS tunneling patterns — high-frequency, low-TTL A-record queries to domains outside normal usage baselines — associated with credential refresh cycles.
- Review outbound HTTPS connections to Google Apps Script endpoints (script.google.com) for traffic patterns inconsistent with legitimate usage by your user population.
- For nuclear and critical infrastructure sector organisations: apply advanced spear-phishing detection to professional outreach email and treat LNK file attachments as high-risk regardless of apparent sender.
- Cross-reference against APT34 and APT42 threat intelligence from the Adversary Wire deep dives for indicator context.