Project CAV3RN Abuses Outlook Calendar Events for C2 Communication and Covert Israeli Surveillance

Key Findings

• Project CAV3RN, an espionage framework targeting Israeli organizations, now uses Outlook calendar events as a command-and-control channel accessed through Microsoft Graph

• The new AzureCommunication.dll module hides commands in calendar events dated to 2050 to avoid detection; operators use encrypted attachments for payload delivery

• If Microsoft Graph fails, the malware retrieves backup credentials through DNS AAAA records, using the recovery domain cloudlanecdn[.]com registered in December 2025

• Kaspersky links CAV3RN to OilRig (APT34) with low confidence; the framework has evolved from a three-part design to a controller-plugin architecture since December 2025

• Known victims include at least one Israeli law firm's compromised Microsoft 365 mailbox; the campaign focuses on espionage rather than financial theft

Background

Kaspersky's GReAT team disclosed the new Project CAV3RN module on July 21, 2026. Researchers have tracked the framework since December 2025, observing rapid evolution in its structure and capabilities. The framework initially consisted of three components—downloader, executor, and uploader. By April 2026, developers shifted to a more flexible controller-based architecture with a seven-character Agent ID system that distributes tasks to modular plugins. This latest communication component represents the second major redesign, swapping out the previous HTTP/WebSocket transport for a cloud-based dead drop mechanism.

How the Calendar Dead Drop Works

The AzureCommunication.dll module transforms a compromised Israeli law firm's Outlook mailbox into an operational dead drop. Operators create calendar events dated to the year 2050, making them invisible in normal calendar views. Each agent uses fixed event subjects to organize traffic: one subject carries commands, another marks heartbeats, and a third holds results.

The module downloads commands, decrypts them using RSA and AES-GCM, then deletes the event. Results travel the same path as fresh encrypted attachments. Only the operators hold the private key needed to decrypt outbound results. This design eliminates traditional network signatures and blends perfectly with legitimate Microsoft Graph traffic, making detection difficult without cloud-side logging.

The DNS Fallback Channel

If Microsoft Graph authentication or tenant validation fails, the module pivots to a DNS backup system. Rather than querying normal DNS records for addresses, it reads IPv6 AAAA responses as raw data and reconstructs tenant and credential settings from those bytes. The recovery domain cloudlanecdn[.]com was registered in December 2025 specifically for this purpose.

The fallback system rotates only credentials, not the domain or encryption keys, meaning operators maintain long-term control even if the primary channel fails. A sentinel IPv6 address signals complete failure, at which point the module stops attempting communication.

Attribution and Suspected Operators

Kaspersky attributes Project CAV3RN to OilRig, also known as APT34, but maintains a low-confidence assessment. The link rests on behavioral patterns rather than direct technical proof. OilRig has a documented history of abusing Microsoft-hosted services for command-and-control, previously exploiting Exchange email, Office 365 drafts, and Outlook drafts. This calendar-event approach fits that established pattern of reusing victims' own infrastructure.

Independent researchers reached similar conclusions. Check Point Research tracked the same framework as "Cavern Manticore," describing it as an Iran-linked C2 system. Group-IB also documented the communication component. However, no direct code reuse between CAV3RN and known OilRig tools has been found, so the connection remains an assessment rather than confirmed attribution.

Campaign Scope and Impact

The known victim is one Israeli law firm's Microsoft 365 mailbox. Kaspersky has not disclosed a total victim count, but the targeting of Israeli organizations and infrastructure suggests a focused espionage operation. The campaign prioritizes data exposure over financial gain, distinguishing it from ransomware or theft-focused operations.

Calendar-based command-and-control represents a growing trend among sophisticated threat actors. Trusted cloud services like Microsoft 365 rarely trigger network blocks, and Graph API traffic blends seamlessly into legitimate organizational activity. This makes the attack class particularly difficult to detect without comprehensive cloud logging and behavioral analysis.

Defensive Recommendations

Defenders can implement several immediate actions. Organizations should review published indicators, particularly the domain cloudlanecdn[.]com. Hunt for calendar events dated to 2050 across Microsoft 365 mailboxes, especially in administrative or shared accounts. Monitor for unusual Graph API calls originating from servers that rarely access mailboxes, and flag AAAA DNS lookups that return non-routable IPv6 data.

Strong application registration controls provide additional protection. Limiting which apps can read mailboxes through Graph API significantly reduces the attack surface these calendar-based C2 techniques depend on. Regular audits of privileged mailbox access and Microsoft Entra application permissions remain essential.

Ongoing Development

Kaspersky reports that Project CAV3RN development remains active with continued framework evolution. Additional modules and updated communication methods are likely as operators refine their operational infrastructure. The shift from HTTP/WebSocket to calendar-based messaging suggests developers will continue exploring cloud services for command-and-control channels, potentially adopting Teams channels, OneDrive metadata, or other Microsoft 365 features in future iterations.

Sources

• https://securityonline.info/project-cav3rn-outlook-calendar-c2/

• https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/