Project CAV3RN

Project CAV3RN is a modular cyberespionage framework used in operations targeting organizations in Israel. Activity associated with the framework has been tracked since late 2025 and remained active through at least mid-2026, with clear evidence of ongoing development and architectural refinement. The framework initially appeared as a simpler downloader-executor-uploader chain, but later evolved into a controller-and-plugin architecture. In its more mature form, a central controller manages agent identity, polling, task routing, and built-in commands, while separate modules provide communications and extensible functionality. This progression indicates a deliberate effort to improve operational flexibility, resilience, and maintainability. A notable Project CAV3RN communications component uses Microsoft Graph to access Outlook calendar data in a compromised Microsoft 365 mailbox and turns calendar events into a dead-drop command-and-control channel. Operators place encrypted tasking in specially formatted calendar events, and infected systems retrieve, decrypt, and remove those events before returning encrypted execution results through attachments in newly created events. The use of far-future event dates reduces visibility in normal user workflows and helps conceal malicious activity inside legitimate cloud services. The framework also incorporates a fallback recovery mechanism based on DNS AAAA-record queries. If cloud authentication or tenant validation fails, the malware can reconstruct replacement Microsoft 365 configuration values from data encoded in DNS responses served by actor-controlled infrastructure. This secondary channel is designed to restore access to the primary cloud-based command path rather than replace it entirely, demonstrating an emphasis on persistence and operational continuity. Observed tradecraft includes abuse of trusted cloud platforms for command and control, encrypted attachment-based task exchange, modular plugin execution, heartbeat signaling, and redundant communications design. The malware uses strong cryptographic protections for command delivery and result exfiltration, limiting visibility into tasking and helping ensure that only the operators can decrypt returned data. Project CAV3RN has been linked by some researchers to the activity cluster also referred to as Cavern Manticore. There is low-confidence assessment of an association with the Iran-aligned threat actor OilRig, also known as APT34, based on behavioral and operational similarities such as espionage targeting aligned with Israeli interests, use of Microsoft-hosted services for command and control, attachment-based exchanges, and mechanisms to recover cloud C2 access. However, direct code-reuse evidence publicly tying Project CAV3RN to OilRig has not been established, so that attribution should be treated as provisional rather than confirmed.