Loading story…
Researchers reported that the Project CAV3RN espionage framework, used against targets in Israel, has expanded with new components that improve stealth and operational resilience. A newly identified module, GoogleService.dll, uses DNS A record responses to decide whether malware should communicate directly over HTTPS with command-and-control infrastructure or route traffic through a Google Apps Script relay, helping activity blend into legitimate cloud service use.
The report also identified a local broker component, rnp.dll, that discovers, loads, upgrades, and routes messages between DLL-based modules at runtime, indicating a more modular and adaptable framework. Investigators linked the activity to infrastructure built around studiotikva[.]com, api.studiotikva[.]com, and actor-controlled nameservers, and noted that the domain was re-registered after expiring, underscoring continued maintenance of the operation and an evolution toward multi-transport, DNS-assisted command-and-control.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Continued tracking in early August 2026 uncovered previously undocumented Project CAV3RN components that expanded the framework's communication and orchestration capabilities. The findings included the GoogleService.dll communication module and the rnp.dll local broker component.
A Cavern-associated module dubbed HOLLOWGRAPH was first detected in the wild using Microsoft 365 calendar events and the Microsoft Graph API as a covert command-and-control channel. Reporting also said it used DNS tunneling to refresh Microsoft Entra ID credentials for Graph API authentication.
The domain studiotikva.com, central to Project CAV3RN infrastructure along with api.studiotikva.com and actor-controlled nameservers, appeared to have been re-registered after expiring earlier in the year. This marked a refresh of infrastructure used by the espionage framework.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcemalware.news
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active cyber espionage campaign linked with moderate confidence to **APT36** (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to **Afghan Telecom**, government updates, and software installers. The operation uses a malware cluster that includes **HACKERAI C2 Agent**, **PATCHCORD**, and **SHEETCORD**, showing an evolution from earlier custom C/C++ tooling to newer **Go-based implants**. The malware uses legitimate cloud services as covert command-and-control channels, with **HACKERAI** abusing **GitHub Gists** and **SHEETCORD** using **Google Sheets** for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple `SHA-256` hashes.
Aug 26, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Google Threat Intelligence Group (**GTIG**), *Mandiant*, and industry partners reported disrupting infrastructure used by suspected China-nexus cyber-espionage actor **UNC2814**, assessed to have breached **at least 53 organizations across 42 countries**, with additional suspected infections in **20+** more countries. The activity primarily targeted **government** and **telecommunications** networks across Africa, Asia, and the Americas, and used **SaaS API calls** to blend command-and-control (C2) traffic into legitimate cloud application activity; the initial access vector remains under investigation, though the actor has a history of exploiting **web servers and edge systems**. The disrupted campaign featured a new C-based backdoor, **GRIDTIDE**, which abuses the **Google Sheets API** as an evasive C2 channel to exchange commands and data. Reported capabilities include arbitrary shell command execution and file upload/download; the malware authenticates using a Google service account (including a hardcoded private key), uses spreadsheet cells (e.g., `A1` for command/status and `A2:An` for output/exfiltration), and implements polling logic that shifts to less frequent randomized checks to reduce noise. Post-compromise tradecraft included lateral movement via **SSH** using a service account, **living-off-the-land** activity for recon/privilege escalation/persistence, persistence via a systemd service at `/etc/systemd/system/xapt.service` launching `/usr/sbin/xapt`, and use of **SoftEther VPN Bridge** to establish encrypted outbound connectivity.
Jun 29, 2026